<html><head><style type="text/css">* {font-family: Arial; font-size: 12px;} i { color: #666; } .footer{position:fixed; bottom:-10; right: 10px; width: 50px; height: 25px; padding-left: 20px; background-color: #eeeeee; border: 1px solid #000; } .func {padding: 10px;background-color: #eeeeee;margin: 10px; border-radius: 15px; border: 1px solid #999;} .title {border-radius: 15px;background-color: #dddddd;padding: 20px;} .paramdesc {padding-top: 10px;padding-left: 10px;padding-bottom: 10px;} h3 {font-size: 16px;} h2 {font-size: 18px;color: #5010FF;} h1 {font-size: 25px; color: #333;} .spaceleft {margin-left: 10px;}a {color: #0000F0;text-decoration: none;}</style></head><body><a name="top"><h1>Sections</h1></a><ul><li><a href="#Assembly">Assembly</a><li><a href="#Breakpoints">Breakpoints</a><li><a href="#Debugger">Debugger</a><li><a href="#Detours">Detours</a><li><a href="#Disassembly">Disassembly</a><li><a href="#Events">Events</a><li><a href="#Memory">Memory</a><li><a href="#Module">Module</a><li><a href="#Process">Process</a><li><a href="#Registers">Registers</a><li><a href="#Stack">Stack</a><li><a href="#String">String</a><li><a href="#Table">Table</a><li><a href="#Thread">Thread</a></ul><a name="Assembly"><h1>Assembly</h1></a><ul><li><a href="#Assemble">Assemble</a></li><li><a href="#Assembler.Make">Assembler.Make</a></li></ul><div class="func"><a name="Assemble"><h2>Assemble</h2></a><div class="title spaceleft">Assemble( <i>string</i> assemblycode, <i>number</i> address [, <i>boolean</i> writetoprocess] )</div><h3>Description</h3><div class="desc spaceleft">Returns the assembled code.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> assemblycode<br /><div class="paramdesc">Assembly instruction</div></li><li><i>number</i> address<br /><div class="paramdesc">Address where the code will be relocated to.</div></li><li>(optional) <i>boolean</i> writetoprocess<br /><div class="paramdesc">If this is true it will also overwrite the memory in process  at the given address.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> data</li><li><i>string</i> error</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">If the function fails data will be nil and the error is given.</div></div><div class="func"><a name="Assembler.Make"><h2>Assembler.Make</h2></a><div class="title spaceleft">Assembler.Make( <i>number</i> ip, <i>string</i> code )</div><h3>Description</h3><div class="desc spaceleft">This is a little wrapper for the Assemble function, it supports multiple commands, labels and comments.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> ip<br /><div class="paramdesc">Where to relocate the code</div></li><li><i>string</i> code<br /><div class="paramdesc">The code to assemble, to define a label you must use '@labelname:', to use a label use '$labelname'</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> bytecode</li><li><i>string</i> error</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Do not forget that OllyDbg accepts only hex, so if you want to pass numbers in code make use of string.hex in utils.lua, consider defining _DEBUG for extended error reporting.</div></div><a name="Breakpoints"><h1>Breakpoints</h1></a><ul><li><a href="#RemoveInt3Breakpoint">RemoveInt3Breakpoint</a></li><li><a href="#SetInt3Breakpoint">SetInt3Breakpoint</a></li><li><a href="#EnableInt3Breakpoint">EnableInt3Breakpoint</a></li><li><a href="#RemoveMemBreakpoint">RemoveMemBreakpoint</a></li><li><a href="#SetMemBreakpoint">SetMemBreakpoint</a></li><li><a href="#EnableMemBreakpoint">EnableMemBreakpoint</a></li><li><a href="#RemoveHardBreakpoint">RemoveHardBreakpoint</a></li><li><a href="#SetHardBreakpoint">SetHardBreakpoint</a></li><li><a href="#EnableHardBreakpoint">EnableHardBreakpoint</a></li><li><a href="#FindFreeHardBreakSlot">FindFreeHardBreakSlot</a></li><li><a href="#ConfirmInt3Breakpoint">ConfirmInt3Breakpoint</a></li><li><a href="#ConfirmHardwareBreakpoint">ConfirmHardwareBreakpoint</a></li><li><a href="#ConfirmInt3BreakpointList">ConfirmInt3BreakpointList</a></li><li><a href="#SetNXBreakpoint">SetNXBreakpoint</a></li><li><a href="#RemoveNXBreakpoint">RemoveNXBreakpoint</a></li></ul><div class="func"><a name="RemoveInt3Breakpoint"><h2>RemoveInt3Breakpoint</h2></a><div class="title spaceleft">RemoveInt3Breakpoint( <i>number</i> address [, <i>number</i> flags] )</div><h3>Description</h3><div class="desc spaceleft">Removes a Int3 Breakpoint at the given address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to remove the Breakpoint.</div></li><li>(optional) <i>number</i> flags<br /><div class="paramdesc">See the <a href="#BP_">BP_</a> flags, for comfort the default flags are (BP_MANUAL | BP_SET | BP_BREAK) to remove a breakpoint.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Passing the wrong flags may not remove the breakpoint, be careful what flags you use.</div></div><div class="func"><a name="SetInt3Breakpoint"><h2>SetInt3Breakpoint</h2></a><div class="title spaceleft">SetInt3Breakpoint( <i>number</i> address [, <i>number</i> flags] [, <i>number</i> functionindex] [, <i>number</i> limit] [, <i>number</i> count] [, <i>string</i> condition] [, <i>string</i> expression] [, <i>string</i> expressiontype] )</div><h3>Description</h3><div class="desc spaceleft">Sets a Int3 Breakpoint at the given address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to set the breakpoint.</div></li><li>(optional) <i>number</i> flags<br /><div class="paramdesc">See the <a href="#BP_">BP_</a> flags, for comfort the default flags are (BP_MANUAL | BP_SET | BP_BREAK) to remove a breakpoint.</div></li><li>(optional) <i>number</i> functionindex<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>number</i> limit<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>number</i> count<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>string</i> condition<br /><div class="paramdesc">Condition to break</div></li><li>(optional) <i>string</i> expression<br /><div class="paramdesc">Expression when breaking</div></li><li>(optional) <i>string</i> expressiontype<br /><div class="paramdesc">Expression type</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Passing the wrong flags may not set the breakpoint, be careful what flags you use.</div></div><div class="func"><a name="EnableInt3Breakpoint"><h2>EnableInt3Breakpoint</h2></a><div class="title spaceleft">EnableInt3Breakpoint( <i>number</i> address, <i>boolean</i> enabled )</div><h3>Description</h3><div class="desc spaceleft">Enables or disables a breakpoint.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Which breakpoint to enable or disable.</div></li><li><i>boolean</i> enabled<br /><div class="paramdesc">Enabled or disabled</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">This function also flushes the memory cache, currently OllyDbg would throw a information otherwise.</div></div><div class="func"><a name="RemoveMemBreakpoint"><h2>RemoveMemBreakpoint</h2></a><div class="title spaceleft">RemoveMemBreakpoint( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Removes a memory breakpoint at the given address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to remove the breakpoint.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="SetMemBreakpoint"><h2>SetMemBreakpoint</h2></a><div class="title spaceleft">SetMemBreakpoint( <i>number</i> address, <i>number</i> size [, <i>number</i> type] [, <i>number</i> limit] [, <i>number</i> count] [, <i>string</i> condition] [, <i>string</i> expression] [, <i>string</i> expressiontype] )</div><h3>Description</h3><div class="desc spaceleft">Sets a memory breakpoint at the given address with the given size.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to set the breakpoint.</div></li><li><i>number</i> size<br /><div class="paramdesc">Size of memory region.</div></li><li>(optional) <i>number</i> type<br /><div class="paramdesc">See <a href="#BP_">BP_</a> flags, for comfort default flags are (BP_MANUAL | BP_READ | BP_WRITE | BP_BREAK)</div></li><li>(optional) <i>number</i> limit<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>number</i> count<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>string</i> condition<br /><div class="paramdesc">Condition to break</div></li><li>(optional) <i>string</i> expression<br /><div class="paramdesc">Expression when breaking</div></li><li>(optional) <i>string</i> expressiontype<br /><div class="paramdesc">Expression type</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="EnableMemBreakpoint"><h2>EnableMemBreakpoint</h2></a><div class="title spaceleft">EnableMemBreakpoint( <i>number</i> address, <i>boolean</i> enabled )</div><h3>Description</h3><div class="desc spaceleft">Enables or disables a breakpoint.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to set the breakpoint.</div></li><li><i>boolean</i> enabled<br /><div class="paramdesc">Enabled or disabled</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="RemoveHardBreakpoint"><h2>RemoveHardBreakpoint</h2></a><div class="title spaceleft">RemoveHardBreakpoint( <i>number</i> slot )</div><h3>Description</h3><div class="desc spaceleft">Removes a hardware breakpoint of the given slot.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> slot<br /><div class="paramdesc">Which slot to clear.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="SetHardBreakpoint"><h2>SetHardBreakpoint</h2></a><div class="title spaceleft">SetHardBreakpoint( <i>number</i> slot, <i>number</i> address, <i>number</i> flags [, <i>number</i> functionindex] [, <i>number</i> limit] [, <i>number</i> count] [, <i>string</i> condition] [, <i>string</i> expression] [, <i>string</i> expressiontype] )</div><h3>Description</h3><div class="desc spaceleft">Sets a hardware breakpoint at the given address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> slot<br /><div class="paramdesc">Which slot to assign.</div></li><li><i>number</i> address<br /><div class="paramdesc">Address for breakpoint.</div></li><li><i>number</i> flags<br /><div class="paramdesc">See <a href="#BP_">BP_</a> flags, for comfort the default flags are (BP_MANUAL | BP_EXEC | BP_BREAK).</div></li><li>(optional) <i>number</i> functionindex<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>number</i> limit<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>number</i> count<br /><div class="paramdesc">Default value is 0 (Undocumented in SDK)</div></li><li>(optional) <i>string</i> condition<br /><div class="paramdesc">Condition to break</div></li><li>(optional) <i>string</i> expression<br /><div class="paramdesc">Expression when breaking</div></li><li>(optional) <i>string</i> expressiontype<br /><div class="paramdesc">Expression type</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Consider using <a href="#FindFreeHardBreakSlot ">FindFreeHardBreakSlot </a>to obtain a free slot.</div></div><div class="func"><a name="EnableHardBreakpoint"><h2>EnableHardBreakpoint</h2></a><div class="title spaceleft">EnableHardBreakpoint( <i>number</i> slot, <i>boolean</i> enabled )</div><h3>Description</h3><div class="desc spaceleft">Enables or disables a breakpoint.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> slot<br /><div class="paramdesc">Which slot to assign.</div></li><li><i>boolean</i> enabled<br /><div class="paramdesc">Enabled or disabled.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="FindFreeHardBreakSlot"><h2>FindFreeHardBreakSlot</h2></a><div class="title spaceleft">FindFreeHardBreakSlot(  )</div><h3>Description</h3><div class="desc spaceleft">Finds a free hardware slot.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> slot</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">When there are no slots free it will return -1</div></div><div class="func"><a name="ConfirmInt3Breakpoint"><h2>ConfirmInt3Breakpoint</h2></a><div class="title spaceleft">ConfirmInt3Breakpoint( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Confirms a Int3 Breakpoint</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Which breakpoint to confirm.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="ConfirmHardwareBreakpoint"><h2>ConfirmHardwareBreakpoint</h2></a><div class="title spaceleft">ConfirmHardwareBreakpoint( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Confirms a Hardware Breakpoint</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Which breakpoint to confirm.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="ConfirmInt3BreakpointList"><h2>ConfirmInt3BreakpointList</h2></a><div class="title spaceleft">ConfirmInt3BreakpointList( <i>table</i> addresses )</div><h3>Description</h3><div class="desc spaceleft">Confirms a list of Int3 breakpoints.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>table</i> addresses<br /><div class="paramdesc">A list of breakpoints to confirm.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="SetNXBreakpoint"><h2>SetNXBreakpoint</h2></a><div class="title spaceleft">SetNXBreakpoint( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Places a NX breakpoint on the memory region.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Memory address for NX breakpoint.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">This feature will only work if the XD bit is enabled in the bios and DEP is enabled.</div></div><div class="func"><a name="RemoveNXBreakpoint"><h2>RemoveNXBreakpoint</h2></a><div class="title spaceleft">RemoveNXBreakpoint( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Removes a NX breakpoint.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address of breakpoint.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">This feature will only work if the XD bit is enabled in the bios and DEP is enabled.</div></div><a name="Debugger"><h1>Debugger</h1></a><ul><li><a href="#StepIn">StepIn</a></li><li><a href="#StepOver">StepOver</a></li><li><a href="#StepOver">StepOver</a></li><li><a href="#StepReturn">StepReturn</a></li><li><a href="#StepOverReturn">StepOverReturn</a></li><li><a href="#TraceIn">TraceIn</a></li><li><a href="#TraceOver">TraceOver</a></li><li><a href="#RedrawCPUDisasm">RedrawCPUDisasm</a></li><li><a href="#RedrawCPUReg">RedrawCPUReg</a></li><li><a href="#SuspendAllThreads">SuspendAllThreads</a></li><li><a href="#SuspendAllThreads">SuspendAllThreads</a></li><li><a href="#PauseProcess">PauseProcess</a></li><li><a href="#CloseProcess">CloseProcess</a></li><li><a href="#DetachProcess">DetachProcess</a></li><li><a href="#GetCPUThreadId">GetCPUThreadId</a></li><li><a href="#SetCPU">SetCPU</a></li><li><a href="#RedrawAll">RedrawAll</a></li><li><a href="#SuppressCPUDrawing">SuppressCPUDrawing</a></li><li><a href="#MsgBox">MsgBox</a></li><li><a href="#InputBox">InputBox</a></li><li><a href="#GetSaveFile">GetSaveFile</a></li><li><a href="#GetOpenFile">GetOpenFile</a></li></ul><div class="func"><a name="StepIn"><h2>StepIn</h2></a><div class="title spaceleft">StepIn( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signals to the debugger to Step-In</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="StepOver"><h2>StepOver</h2></a><div class="title spaceleft">StepOver( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to Step-Over</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="StepOver"><h2>StepOver</h2></a><div class="title spaceleft">StepOver( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to Continue the process.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="StepReturn"><h2>StepReturn</h2></a><div class="title spaceleft">StepReturn( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to step until a return.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="StepOverReturn"><h2>StepOverReturn</h2></a><div class="title spaceleft">StepOverReturn( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to step until a return including the return.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="TraceIn"><h2>TraceIn</h2></a><div class="title spaceleft">TraceIn( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to trace in</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="TraceOver"><h2>TraceOver</h2></a><div class="title spaceleft">TraceOver( <i>boolean</i> PassException )</div><h3>Description</h3><div class="desc spaceleft">Signal the debugger to trace over.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> PassException<br /><div class="paramdesc">Pass last exception to application.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="RedrawCPUDisasm"><h2>RedrawCPUDisasm</h2></a><div class="title spaceleft">RedrawCPUDisasm(  )</div><h3>Description</h3><div class="desc spaceleft">Forces OllyDbg to redraw the CPU disassembly.</div><h3>Remarks</h3><div class="remarks spaceleft">Function will fail if CPU drawing is suppressed.</div></div><div class="func"><a name="RedrawCPUReg"><h2>RedrawCPUReg</h2></a><div class="title spaceleft">RedrawCPUReg(  )</div><h3>Description</h3><div class="desc spaceleft">Forces OllyDbg to redraw the CPU registers.</div><h3>Remarks</h3><div class="remarks spaceleft">Function will fail if CPU drawing is suppressed.</div></div><div class="func"><a name="SuspendAllThreads"><h2>SuspendAllThreads</h2></a><div class="title spaceleft">SuspendAllThreads(  )</div><h3>Description</h3><div class="desc spaceleft">Suspends all running threads.</div></div><div class="func"><a name="SuspendAllThreads"><h2>SuspendAllThreads</h2></a><div class="title spaceleft">SuspendAllThreads(  )</div><h3>Description</h3><div class="desc spaceleft">Resumes all paused threads.</div></div><div class="func"><a name="PauseProcess"><h2>PauseProcess</h2></a><div class="title spaceleft">PauseProcess(  )</div><h3>Description</h3><div class="desc spaceleft">Attempts to pause the current running process.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="CloseProcess"><h2>CloseProcess</h2></a><div class="title spaceleft">CloseProcess( <i>boolean</i> confirm )</div><h3>Description</h3><div class="desc spaceleft">Closes the current process, also shows a confirmation dialog if requested.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> confirm<br /><div class="paramdesc">Shows a confirmation dialog if true.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="DetachProcess"><h2>DetachProcess</h2></a><div class="title spaceleft">DetachProcess(  )</div><h3>Description</h3><div class="desc spaceleft">Will detach from the process but leaves it running.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="GetCPUThreadId"><h2>GetCPUThreadId</h2></a><div class="title spaceleft">GetCPUThreadId(  )</div><h3>Description</h3><div class="desc spaceleft">Will retrieve the current thread id.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> threadid</li></ol></div></div><div class="func"><a name="SetCPU"><h2>SetCPU</h2></a><div class="title spaceleft">SetCPU( <i>number</i> threadid, <i>number</i> cpuaddress, <i>number</i> dumpaddress, <i>number</i> stackaddress, <i>number</i> flags )</div><h3>Description</h3><div class="desc spaceleft">Sets the current CPU in OllyDbg</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> threadid<br /><div class="paramdesc">Thread ID to switch to.</div></li><li><i>number</i> cpuaddress<br /><div class="paramdesc">Address to show in disassembly view.</div></li><li><i>number</i> dumpaddress<br /><div class="paramdesc">Address to show in dump view.</div></li><li><i>number</i> stackaddress<br /><div class="paramdesc">Address to show in stack view.</div></li><li><i>number</i> flags<br /><div class="paramdesc">The flags will decide which parameter will be set, see <a href="#CPU_">CPU_</a> flags.</div></li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Function will fail if CPU drawing is suppressed.</div></div><div class="func"><a name="RedrawAll"><h2>RedrawAll</h2></a><div class="title spaceleft">RedrawAll(  )</div><h3>Description</h3><div class="desc spaceleft">Forces OllyDbg to redraw all visible elements</div></div><div class="func"><a name="SuppressCPUDrawing"><h2>SuppressCPUDrawing</h2></a><div class="title spaceleft">SuppressCPUDrawing( <i>boolean</i> suppress )</div><h3>Description</h3><div class="desc spaceleft">Forces OllyDbg to stop drawing after certain events such as StepIn, StepOver, Continue. This function can enhance performance in complex scripts.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>boolean</i> suppress<br /><div class="paramdesc">Suppress drawing</div></li></ol></div></div><div class="func"><a name="MsgBox"><h2>MsgBox</h2></a><div class="title spaceleft">MsgBox( <i>string</i> message [, <i>string</i> title] [, <i>number</i> flags] )</div><h3>Description</h3><div class="desc spaceleft">Shows a message box, uses MessageBox</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> message<br /><div class="paramdesc">message</div></li><li>(optional) <i>string</i> title<br /><div class="paramdesc">Title to display, default = ""</div></li><li>(optional) <i>number</i> flags<br /><div class="paramdesc">One of <a href="#MB_">MB_</a> flags, default = MB_OK</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> result Will return #ID_ value.</li></ol></div></div><div class="func"><a name="InputBox"><h2>InputBox</h2></a><div class="title spaceleft">InputBox( <i>string</i> query [, <i>string</i> defaultvalue] )</div><h3>Description</h3><div class="desc spaceleft">Shows a box for the user to enter input</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> query<br /><div class="paramdesc">The query text</div></li><li>(optional) <i>string</i> defaultvalue<br /><div class="paramdesc">Default value</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> answer</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">When the user clicks cancel the result will be nil</div></div><div class="func"><a name="GetSaveFile"><h2>GetSaveFile</h2></a><div class="title spaceleft">GetSaveFile( <i>string</i> filter] [, <i>string</i> title] )</div><h3>Description</h3><div class="desc spaceleft">Shows a dialog for file saving</div><h3>Arguments</h3><div class="params spaceleft"><ol><li>(optional) <i>string</i> filter<br /><div class="paramdesc">Filename filter, can be the format "*.exe;*.dll" or "All Files\0*.*\0\0"</div></li><li>(optional) <i>string</i> title<br /><div class="paramdesc">Title to display in dialog</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> filepath</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">When the user clicks cancel the result will be nil</div></div><div class="func"><a name="GetOpenFile"><h2>GetOpenFile</h2></a><div class="title spaceleft">GetOpenFile( <i>string</i> filter] [, <i>string</i> title] )</div><h3>Description</h3><div class="desc spaceleft">Shows a dialog for file opening</div><h3>Arguments</h3><div class="params spaceleft"><ol><li>(optional) <i>string</i> filter<br /><div class="paramdesc">Filename filter, can be the format "*.exe;*.dll" or "All Files\0*.*\0\0"</div></li><li>(optional) <i>string</i> title<br /><div class="paramdesc">Title to display in dialog</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> filepath</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">When the user clicks cancel the result will be nil</div></div><a name="Detours"><h1>Detours</h1></a><ul><li><a href="#Detours.Add">Detours.Add</a></li><li><a href="#Detours.Remove">Detours.Remove</a></li></ul><div class="func"><a name="Detours.Add"><h2>Detours.Add</h2></a><div class="title spaceleft">Detours.Add( <i>number</i> address, <i>function</i> callback [, <i>number</i> detoursize] )</div><h3>Description</h3><div class="desc spaceleft">Attempts to detour a function, it will call the second parameter which is supposed to return the bytecode for the detour.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">The function to detour</div></li><li><i>function</i> callback<br /><div class="paramdesc">Called as soon the trampoline is ready, this should return the bytecode for the detour.</div></li><li>(optional) <i>number</i> detoursize<br /><div class="paramdesc">The default size is 1024, if your function is bigger you should set this.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="Detours.Remove"><h2>Detours.Remove</h2></a><div class="title spaceleft">Detours.Remove( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Removes a existing detoured function, restores the original data and deletes the trampoline.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Detoured function to restore.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><a name="Disassembly"><h1>Disassembly</h1></a><ul><li><a href="#Disasm">Disasm</a></li><li><a href="#Disasm">Disasm</a></li><li><a href="#LDE">LDE</a></li><li><a href="#LDE">LDE</a></li><li><a href="#SetComment">SetComment</a></li><li><a href="#GetComment">GetComment</a></li><li><a href="#SetLabel">SetLabel</a></li><li><a href="#GetLabel">GetLabel</a></li><li><a href="#IsCommandType">IsCommandType</a></li><li><a href="#IsJmp">IsJmp</a></li><li><a href="#IsFarJmp">IsFarJmp</a></li><li><a href="#IsJmc">IsJmc</a></li><li><a href="#IsPush">IsPush</a></li><li><a href="#IsPop">IsPop</a></li><li><a href="#IsRet">IsRet</a></li><li><a href="#IsCall">IsCall</a></li><li><a href="#IsFarCall">IsFarCall</a></li><li><a href="#IsMove">IsMove</a></li><li><a href="#IsSystemCall">IsSystemCall</a></li></ul><div class="func"><a name="Disasm"><h2>Disasm</h2></a><div class="title spaceleft">Disasm( <i>number</i> address, <i>number</i> size, <i>number</i> ip [, <i>number</i> flags] )</div><h3>Description</h3><div class="desc spaceleft">Disassembles code.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Adress where to read the data.</div></li><li><i>number</i> size<br /><div class="paramdesc">Size of input.</div></li><li><i>number</i> ip<br /><div class="paramdesc">Instruction pointer, doesn't need to be the same as address.</div></li><li>(optional) <i>number</i> flags<br /><div class="paramdesc">Memory reading flags, see <a href="#DA_">DA_</a> flags. Default is (DA_TEXT | DA_OPCOMM)</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> data</li></ol></div></div><div class="func"><a name="Disasm"><h2>Disasm</h2></a><div class="title spaceleft">Disasm( <i>string</i> data, <i>number</i> ip [, <i>number</i> flags] )</div><h3>Description</h3><div class="desc spaceleft">Disassembles code.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> data<br /><div class="paramdesc">Input data to disassemble.</div></li><li><i>number</i> ip<br /><div class="paramdesc">Instruction pointer, doesn't need to be the same as address.</div></li><li>(optional) <i>number</i> flags<br /><div class="paramdesc">Memory reading flags, see <a href="#DA_">DA_</a> flags. Default is (DA_TEXT | DA_OPCOMM)</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> data</li></ol></div></div><div class="func"><a name="LDE"><h2>LDE</h2></a><div class="title spaceleft">LDE( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Returns only the length of the disassembled instruction.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address of where to read data.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> length</li></ol></div></div><div class="func"><a name="LDE"><h2>LDE</h2></a><div class="title spaceleft">LDE( <i>string</i> data )</div><h3>Description</h3><div class="desc spaceleft">Returns only the length of the disassembled instruction.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> data<br /><div class="paramdesc">Data of instruction to process.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> length</li></ol></div></div><div class="func"><a name="SetComment"><h2>SetComment</h2></a><div class="title spaceleft">SetComment( <i>number</i> address, <i>string</i> comment [, <i>boolean</i> redrawcpu] )</div><h3>Description</h3><div class="desc spaceleft">Sets a comment next to the instruction in the CPU disasm</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address to comment</div></li><li><i>string</i> comment<br /><div class="paramdesc">The comment, pass nil to remove the comment</div></li><li>(optional) <i>boolean</i> redrawcpu<br /><div class="paramdesc">Will redraw the CPU window, by default its true</div></li></ol></div></div><div class="func"><a name="GetComment"><h2>GetComment</h2></a><div class="title spaceleft">GetComment( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Gets a comment for a specific address</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address for comment</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> comment</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">If there is no comment specified for the address the return value will be nil</div></div><div class="func"><a name="SetLabel"><h2>SetLabel</h2></a><div class="title spaceleft">SetLabel( <i>number</i> address, <i>string</i> label [, <i>boolean</i> redrawcpu] )</div><h3>Description</h3><div class="desc spaceleft">Sets a label to the address</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address for label</div></li><li><i>string</i> label<br /><div class="paramdesc">The Label, pass nil to remove the label</div></li><li>(optional) <i>boolean</i> redrawcpu<br /><div class="paramdesc">Will redraw the CPU window, by default its true</div></li></ol></div></div><div class="func"><a name="GetLabel"><h2>GetLabel</h2></a><div class="title spaceleft">GetLabel( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Gets a label for a specific address</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address for label</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> label</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">If there is no label specified for the address the return value will be nil</div></div><div class="func"><a name="IsCommandType"><h2>IsCommandType</h2></a><div class="title spaceleft">IsCommandType( <i>number</i> cmdaddress, <i>number</i> cmdtype )</div><h3>Description</h3><div class="desc spaceleft">Returns if the selected command is matching the given type.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li><li><i>number</i> cmdtype<br /><div class="paramdesc">See one of the <a href="#D_">D_</a> flags.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> istype</li></ol></div></div><div class="func"><a name="IsJmp"><h2>IsJmp</h2></a><div class="title spaceleft">IsJmp( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a unconditional jump</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> isjump</li></ol></div></div><div class="func"><a name="IsFarJmp"><h2>IsFarJmp</h2></a><div class="title spaceleft">IsFarJmp( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a unconditional far jump</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> isfarjump</li></ol></div></div><div class="func"><a name="IsJmc"><h2>IsJmc</h2></a><div class="title spaceleft">IsJmc( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a conditional jump</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> iscondjump</li></ol></div></div><div class="func"><a name="IsPush"><h2>IsPush</h2></a><div class="title spaceleft">IsPush( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a push</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> ispush</li></ol></div></div><div class="func"><a name="IsPop"><h2>IsPop</h2></a><div class="title spaceleft">IsPop( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a pop</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> ispop</li></ol></div></div><div class="func"><a name="IsRet"><h2>IsRet</h2></a><div class="title spaceleft">IsRet( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a ret</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> isret</li></ol></div></div><div class="func"><a name="IsCall"><h2>IsCall</h2></a><div class="title spaceleft">IsCall( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a call</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> iscall</li></ol></div></div><div class="func"><a name="IsFarCall"><h2>IsFarCall</h2></a><div class="title spaceleft">IsFarCall( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a far call</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> isfarcall</li></ol></div></div><div class="func"><a name="IsMove"><h2>IsMove</h2></a><div class="title spaceleft">IsMove( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a mov</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> ismov</li></ol></div></div><div class="func"><a name="IsSystemCall"><h2>IsSystemCall</h2></a><div class="title spaceleft">IsSystemCall( <i>number</i> cmdaddress )</div><h3>Description</h3><div class="desc spaceleft">Returns if the command is a system call, keep in mind that this logic can be slow.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> cmdaddress<br /><div class="paramdesc">cmdaddress</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> issystemcall</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">This function attempts to read the call destination and determines if it goes into a system dll.</div></div><a name="Events"><h1>Events</h1></a><ul><li><a href="#Event.Listen">Event.Listen</a></li><li><a href="#Event.Remove">Event.Remove</a></li></ul><div class="func"><a name="Event.Listen"><h2>Event.Listen</h2></a><div class="title spaceleft">Event.Listen( <i>string</i> eventtype, <i>function</i> callback )</div><h3>Description</h3><div class="desc spaceleft">Listens to a specific Playtime event, calls the callback given as parameter</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> eventtype<br /><div class="paramdesc">The event to listen to</div></li><li><i>function</i> callback<br /><div class="paramdesc">Callback function</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> eventhandle</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">The type can be 'Exception', 'CreateThread', 'ExitThread', 'LoadDll', 'UnloadDll', 'Int3Breakpoint', 'DebugString'</div></div><div class="func"><a name="Event.Remove"><h2>Event.Remove</h2></a><div class="title spaceleft">Event.Remove( <i>number</i> eventhandle )</div><h3>Description</h3><div class="desc spaceleft">Removes a event listener by handle.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> eventhandle<br /><div class="paramdesc">eventhandle</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><a name="Memory"><h1>Memory</h1></a><ul><li><a href="#FindMemroy">FindMemroy</a></li><li><a href="#Memory">Memory</a></li><li><a href="#WriteMemory">WriteMemory</a></li><li><a href="#FillMemory">FillMemory</a></li><li><a href="#ReadMemory">ReadMemory</a></li><li><a href="#ReadMemoryEx">ReadMemoryEx</a></li><li><a href="#ReadMemoryULong">ReadMemoryULong</a></li><li><a href="#ReadMemoryLong">ReadMemoryLong</a></li><li><a href="#ReadMemoryUShort">ReadMemoryUShort</a></li><li><a href="#ReadMemoryShort">ReadMemoryShort</a></li><li><a href="#ReadMemoryUChar">ReadMemoryUChar</a></li><li><a href="#ReadMemoryChar">ReadMemoryChar</a></li><li><a href="#WriteMemoryULong">WriteMemoryULong</a></li><li><a href="#WriteMemoryLong">WriteMemoryLong</a></li><li><a href="#WriteMemoryUShort">WriteMemoryUShort</a></li><li><a href="#WriteMemoryShort">WriteMemoryShort</a></li><li><a href="#WriteMemoryUChar">WriteMemoryUChar</a></li><li><a href="#WriteMemoryChar">WriteMemoryChar</a></li><li><a href="#IsSystemAddress">IsSystemAddress</a></li><li><a href="#RemoteAlloc">RemoteAlloc</a></li><li><a href="#RemoteAllocEx">RemoteAllocEx</a></li><li><a href="#RemoteFree">RemoteFree</a></li><li><a href="#RemoteFreeEx">RemoteFreeEx</a></li><li><a href="#RemoteProtect">RemoteProtect</a></li><li><a href="#ReadMemoryString">ReadMemoryString</a></li><li><a href="#ReadMemoryUnicodeString">ReadMemoryUnicodeString</a></li><li><a href="#WriteMemoryString">WriteMemoryString</a></li></ul><div class="func"><a name="FindMemroy"><h2>FindMemroy</h2></a><div class="title spaceleft">FindMemroy( <i>number</i> address, <i>string</i> signature )</div><h3>Description</h3><div class="desc spaceleft">Will search for the given signature in the memory, returns nil if nothing found.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to start the search.</div></li><li><i>string</i> signature<br /><div class="paramdesc">Signature to search search, must be hexadecimal (%02X, %02x) or ?? as anything.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> position</li></ol></div></div><div class="func"><a name="Memory"><h2>Memory</h2></a><div class="title spaceleft">Memory( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Gets the information about a memory region.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Memory address.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> memoryinfo</li></ol></div></div><div class="func"><a name="WriteMemory"><h2>WriteMemory</h2></a><div class="title spaceleft">WriteMemory( <i>number</i> address, <i>string</i> data [, <i>number</i> size] )</div><h3>Description</h3><div class="desc spaceleft">Writes memory to given address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to write to.</div></li><li><i>string</i> data<br /><div class="paramdesc">The data to write.</div></li><li>(optional) <i>number</i> size<br /><div class="paramdesc">If this is given the data will be only the size of this parameter.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div></div><div class="func"><a name="FillMemory"><h2>FillMemory</h2></a><div class="title spaceleft">FillMemory( <i>number</i> address, <i>number</i> count, <i>number</i> byte )</div><h3>Description</h3><div class="desc spaceleft">Fill memory at given address with the given byte.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to write to.</div></li><li><i>number</i> count<br /><div class="paramdesc">Count of bytes to write.</div></li><li><i>number</i> byte<br /><div class="paramdesc">The byte to write by count.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div></div><div class="func"><a name="ReadMemory"><h2>ReadMemory</h2></a><div class="title spaceleft">ReadMemory( <i>number</i> address, <i>number</i> size [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Reads memory at the given address with the requested size.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> size<br /><div class="paramdesc">How much bytes to read.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> data</li></ol></div></div><div class="func"><a name="ReadMemoryEx"><h2>ReadMemoryEx</h2></a><div class="title spaceleft">ReadMemoryEx( <i>number</i> address, <i>number</i> size, <i>number</i> flags [, <i>number</i> threadid] )</div><h3>Description</h3><div class="desc spaceleft">Reads memory at the given address with the requested size with extra flags.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> size<br /><div class="paramdesc">How much bytes to read.</div></li><li><i>number</i> flags<br /><div class="paramdesc">One of the <a href="#MM_">MM_</a> flags.</div></li><li>(optional) <i>number</i> threadid<br /><div class="paramdesc">Undocumented parameter.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">You should always pass MM_SILENT to the flags if you don't want OllyDbg to show error messages in case of a failure.</div></div><div class="func"><a name="ReadMemoryULong"><h2>ReadMemoryULong</h2></a><div class="title spaceleft">ReadMemoryULong( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a unsigned long (32 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use DWORD_PTR[address]</div></div><div class="func"><a name="ReadMemoryLong"><h2>ReadMemoryLong</h2></a><div class="title spaceleft">ReadMemoryLong( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a long (31 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use DWORD_PTR[address]</div></div><div class="func"><a name="ReadMemoryUShort"><h2>ReadMemoryUShort</h2></a><div class="title spaceleft">ReadMemoryUShort( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a unsigned short (16 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use WORD_PTR[address]</div></div><div class="func"><a name="ReadMemoryShort"><h2>ReadMemoryShort</h2></a><div class="title spaceleft">ReadMemoryShort( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a short (15 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use WORD_PTR[address]</div></div><div class="func"><a name="ReadMemoryUChar"><h2>ReadMemoryUChar</h2></a><div class="title spaceleft">ReadMemoryUChar( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a short (8 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use BYTE_PTR[address]</div></div><div class="func"><a name="ReadMemoryChar"><h2>ReadMemoryChar</h2></a><div class="title spaceleft">ReadMemoryChar( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Read a char (7 bit) from the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Will temporarily remove the breakpoints when reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> data</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use BYTE_PTR[address]</div></div><div class="func"><a name="WriteMemoryULong"><h2>WriteMemoryULong</h2></a><div class="title spaceleft">WriteMemoryULong( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a unsigned long (32 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use DWORD_PTR[address]</div></div><div class="func"><a name="WriteMemoryLong"><h2>WriteMemoryLong</h2></a><div class="title spaceleft">WriteMemoryLong( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a long (31 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use DWORD_PTR[address]</div></div><div class="func"><a name="WriteMemoryUShort"><h2>WriteMemoryUShort</h2></a><div class="title spaceleft">WriteMemoryUShort( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a unsigned short (16 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use WORD_PTR[address]</div></div><div class="func"><a name="WriteMemoryShort"><h2>WriteMemoryShort</h2></a><div class="title spaceleft">WriteMemoryShort( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a short (15 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use WORD_PTR[address]</div></div><div class="func"><a name="WriteMemoryUChar"><h2>WriteMemoryUChar</h2></a><div class="title spaceleft">WriteMemoryUChar( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a unsigned char (8 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use BYTE_PTR[address]</div></div><div class="func"><a name="WriteMemoryChar"><h2>WriteMemoryChar</h2></a><div class="title spaceleft">WriteMemoryChar( <i>number</i> address, <i>number</i> value )</div><h3>Description</h3><div class="desc spaceleft">Write a char (7 bit) to the memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Where to read from.</div></li><li><i>number</i> value<br /><div class="paramdesc">The data value.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> byteswritten</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">As an alternative you can use BYTE_PTR[address]</div></div><div class="func"><a name="IsSystemAddress"><h2>IsSystemAddress</h2></a><div class="title spaceleft">IsSystemAddress( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Returns if the given Address is a system specific address such as kernel32.dll, kernelbase.dll and so on.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">The address to check.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> systemaddress</li></ol></div></div><div class="func"><a name="RemoteAlloc"><h2>RemoteAlloc</h2></a><div class="title spaceleft">RemoteAlloc( <i>number</i> size [, <i>number</i> address] [, <i>number</i> protect] )</div><h3>Description</h3><div class="desc spaceleft">Allocates (size) memory on the debugged process.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> size<br /><div class="paramdesc">Size in bytes to allocate.</div></li><li>(optional) <i>number</i> address<br /><div class="paramdesc">Address where to allocate to, must be free or fails, default is 0.</div></li><li>(optional) <i>number</i> protect<br /><div class="paramdesc">Protect flags see <a href="#PAGE_">PAGE_</a>, default is PAGE_READWRITE.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> memoryaddress</li></ol></div></div><div class="func"><a name="RemoteAllocEx"><h2>RemoteAllocEx</h2></a><div class="title spaceleft">RemoteAllocEx( <i>number</i> size, <i>number</i> alloctype [, <i>number</i> address] [, <i>number</i> protect] )</div><h3>Description</h3><div class="desc spaceleft">Allocates (size) memory on the debugged process.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> size<br /><div class="paramdesc">Size in bytes to allocate.</div></li><li><i>number</i> alloctype<br /><div class="paramdesc">The memory type, see one of <a href="#MEM_">MEM_</a> flags, default is (MEM_COMMIT | MEM_RESERVE).</div></li><li>(optional) <i>number</i> address<br /><div class="paramdesc">Address where to allocate to, must be free or fails, default is 0.</div></li><li>(optional) <i>number</i> protect<br /><div class="paramdesc">Protect flags see <a href="#PAGE_">PAGE_</a>, default is PAGE_READWRITE.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> memoryaddress</li></ol></div></div><div class="func"><a name="RemoteFree"><h2>RemoteFree</h2></a><div class="title spaceleft">RemoteFree( <i>number</i> address, <i>number</i> size )</div><h3>Description</h3><div class="desc spaceleft">Attempts to free the allocated memory on debugged process.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">The memory region to deallocate.</div></li><li><i>number</i> size<br /><div class="paramdesc">Size of region.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="RemoteFreeEx"><h2>RemoteFreeEx</h2></a><div class="title spaceleft">RemoteFreeEx( <i>number</i> address, <i>number</i> size [, <i>number</i> freetype] )</div><h3>Description</h3><div class="desc spaceleft">Attempts to free the allocated memory on debugged process.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">The memory region to deallocate.</div></li><li><i>number</i> size<br /><div class="paramdesc">Size of region.</div></li><li>(optional) <i>number</i> freetype<br /><div class="paramdesc">See one of <a href="#MEM_">MEM_</a> flags, default is (MEM_RELEASE)</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li></ol></div></div><div class="func"><a name="RemoteProtect"><h2>RemoteProtect</h2></a><div class="title spaceleft">RemoteProtect( <i>number</i> address, <i>number</i> size, <i>number</i> protect )</div><h3>Description</h3><div class="desc spaceleft">Changes the protection flags on memory.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Memory address to change.</div></li><li><i>number</i> size<br /><div class="paramdesc">Size of region.</div></li><li><i>number</i> protect<br /><div class="paramdesc">New protection flags, see <a href="#PAGE_">PAGE_</a>.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> success</li><li><i>number</i> oldprotection</li></ol></div></div><div class="func"><a name="ReadMemoryString"><h2>ReadMemoryString</h2></a><div class="title spaceleft">ReadMemoryString( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Attempts to read a multibyte string from given memory address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address where to read the string.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Removes temporarily breakpoints at the address reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> str</li></ol></div></div><div class="func"><a name="ReadMemoryUnicodeString"><h2>ReadMemoryUnicodeString</h2></a><div class="title spaceleft">ReadMemoryUnicodeString( <i>number</i> address [, <i>boolean</i> removeint3breakpoints] )</div><h3>Description</h3><div class="desc spaceleft">Attempts to read a unicode string from given memory address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address where to read the string.</div></li><li>(optional) <i>boolean</i> removeint3breakpoints<br /><div class="paramdesc">Removes temporarily breakpoints at the address reading.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> str</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">This function reads UTF16 which means each character is 2 bytes big.</div></div><div class="func"><a name="WriteMemoryString"><h2>WriteMemoryString</h2></a><div class="title spaceleft">WriteMemoryString( <i>number</i> address, <i>string</i> str )</div><h3>Description</h3><div class="desc spaceleft">Writes a multibyte string to the given memory address including the null terminator.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address where to read the string.</div></li><li><i>string</i> str<br /><div class="paramdesc">String to write</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> written</li></ol></div></div><a name="Module"><h1>Module</h1></a><ul><li><a href="#FindModule">FindModule</a></li><li><a href="#FindModuleByName">FindModuleByName</a></li><li><a href="#FindMainModule">FindMainModule</a></li><li><a href="#GPA">GPA</a></li><li><a href="#Module.IsValid">Module.IsValid</a></li><li><a href="#Module.Base">Module.Base</a></li><li><a href="#Module.Size">Module.Size</a></li><li><a href="#Module.Type">Module.Type</a></li><li><a href="#Module.Name">Module.Name</a></li><li><a href="#Module.Path">Module.Path</a></li><li><a href="#Module.Version">Module.Version</a></li><li><a href="#Module.FixupBase">Module.FixupBase</a></li><li><a href="#Module.CodeBase">Module.CodeBase</a></li><li><a href="#Module.CodeSize">Module.CodeSize</a></li><li><a href="#Module.Entry">Module.Entry</a></li><li><a href="#Module.GetSections">Module.GetSections</a></li><li><a href="#Module.FindSection">Module.FindSection</a></li><li><a href="#Module.SFXEntry">Module.SFXEntry</a></li><li><a href="#Module.WinMain">Module.WinMain</a></li><li><a href="#Module.Database">Module.Database</a></li><li><a href="#Module.ExportDatabase">Module.ExportDatabase</a></li><li><a href="#Module.ExportDataSize">Module.ExportDataSize</a></li><li><a href="#Module.IDATable">Module.IDATable</a></li><li><a href="#Module.IATBase">Module.IATBase</a></li><li><a href="#Module.IATSize">Module.IATSize</a></li><li><a href="#Module.RelocBase">Module.RelocBase</a></li><li><a href="#Module.RelocSize">Module.RelocSize</a></li><li><a href="#Module.ResBase">Module.ResBase</a></li><li><a href="#Module.ResSize">Module.ResSize</a></li><li><a href="#Module.TLSBase">Module.TLSBase</a></li><li><a href="#Module.TLSSize">Module.TLSSize</a></li><li><a href="#Module.TLSCallback">Module.TLSCallback</a></li><li><a href="#Module.SFXBase">Module.SFXBase</a></li><li><a href="#Module.SFXSize">Module.SFXSize</a></li><li><a href="#Module.RawHeaderSize">Module.RawHeaderSize</a></li><li><a href="#Module.MemoryHeaderSize">Module.MemoryHeaderSize</a></li><li><a href="#Module.FindAddress">Module.FindAddress</a></li><li><a href="#Module.VAToRVA">Module.VAToRVA</a></li><li><a href="#Module.RVAToVA">Module.RVAToVA</a></li><li><a href="#Module.RVAToOffset">Module.RVAToOffset</a></li><li><a href="#Module.VAToOffset">Module.VAToOffset</a></li><li><a href="#Module.OffsetToRVA">Module.OffsetToRVA</a></li><li><a href="#Module.OffsetToVA">Module.OffsetToVA</a></li></ul><div class="func"><a name="FindModule"><h2>FindModule</h2></a><div class="title spaceleft">FindModule( <i>number</i> address )</div><h3>Description</h3><div class="desc spaceleft">Attempts to find a module by address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> address<br /><div class="paramdesc">Address of module, its range based.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Module</i> module</li></ol></div></div><div class="func"><a name="FindModuleByName"><h2>FindModuleByName</h2></a><div class="title spaceleft">FindModuleByName( <i>string</i> name )</div><h3>Description</h3><div class="desc spaceleft">Attempts to find a module by its name.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> name<br /><div class="paramdesc">Name of the module, the extension is not required.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Module</i> module</li></ol></div></div><div class="func"><a name="FindMainModule"><h2>FindMainModule</h2></a><div class="title spaceleft">FindMainModule(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the main module, should never fail.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Module</i> module</li></ol></div></div><div class="func"><a name="GPA"><h2>GPA</h2></a><div class="title spaceleft">GPA( <i>string</i> module, <i>string</i> export )</div><h3>Description</h3><div class="desc spaceleft">Helper function to get quickly a exported function address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> module<br /><div class="paramdesc">The module name.</div></li><li><i>string</i> export<br /><div class="paramdesc">The export name.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> address</li></ol></div></div><div class="func"><a name="Module.IsValid"><h2>Module.IsValid</h2></a><div class="title spaceleft">Module.IsValid(  )</div><h3>Description</h3><div class="desc spaceleft">Will return if the module is valid.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> valid</li></ol></div></div><div class="func"><a name="Module.Base"><h2>Module.Base</h2></a><div class="title spaceleft">Module.Base(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the image base.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> imagebase</li></ol></div></div><div class="func"><a name="Module.Size"><h2>Module.Size</h2></a><div class="title spaceleft">Module.Size(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the image size.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> imagesize</li></ol></div></div><div class="func"><a name="Module.Type"><h2>Module.Type</h2></a><div class="title spaceleft">Module.Type(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the image type.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> type</li></ol></div></div><div class="func"><a name="Module.Name"><h2>Module.Name</h2></a><div class="title spaceleft">Module.Name(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the name.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> name</li></ol></div></div><div class="func"><a name="Module.Path"><h2>Module.Path</h2></a><div class="title spaceleft">Module.Path(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the path to the image.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> path</li></ol></div></div><div class="func"><a name="Module.Version"><h2>Module.Version</h2></a><div class="title spaceleft">Module.Version(  )</div><h3>Description</h3><div class="desc spaceleft">Will return the version.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> version.</li></ol></div></div><div class="func"><a name="Module.FixupBase"><h2>Module.FixupBase</h2></a><div class="title spaceleft">Module.FixupBase(  )</div><h3>Description</h3><div class="desc spaceleft">Will return fixup base.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> fixupbase</li></ol></div></div><div class="func"><a name="Module.CodeBase"><h2>Module.CodeBase</h2></a><div class="title spaceleft">Module.CodeBase(  )</div><h3>Description</h3><div class="desc spaceleft">Will return code base</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> codebase</li></ol></div></div><div class="func"><a name="Module.CodeSize"><h2>Module.CodeSize</h2></a><div class="title spaceleft">Module.CodeSize(  )</div><h3>Description</h3><div class="desc spaceleft">Will return code size</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> codesize</li></ol></div></div><div class="func"><a name="Module.Entry"><h2>Module.Entry</h2></a><div class="title spaceleft">Module.Entry(  )</div><h3>Description</h3><div class="desc spaceleft">Will return module entrypoint.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> entry</li></ol></div></div><div class="func"><a name="Module.GetSections"><h2>Module.GetSections</h2></a><div class="title spaceleft">Module.GetSections(  )</div><h3>Description</h3><div class="desc spaceleft">Will return a list of all sections.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> sections</li></ol></div></div><div class="func"><a name="Module.FindSection"><h2>Module.FindSection</h2></a><div class="title spaceleft">Module.FindSection( <i>string</i> name )</div><h3>Description</h3><div class="desc spaceleft">Will get the section by its name.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> name<br /><div class="paramdesc">The section name.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> sectiondata</li></ol></div></div><div class="func"><a name="Module.SFXEntry"><h2>Module.SFXEntry</h2></a><div class="title spaceleft">Module.SFXEntry(  )</div><h3>Description</h3><div class="desc spaceleft">In case olly has automatically found the entry this will be the initial entry.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> entry</li></ol></div></div><div class="func"><a name="Module.WinMain"><h2>Module.WinMain</h2></a><div class="title spaceleft">Module.WinMain(  )</div><h3>Description</h3><div class="desc spaceleft">Address of WinMain entry if it has any.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> entry</li></ol></div></div><div class="func"><a name="Module.Database"><h2>Module.Database</h2></a><div class="title spaceleft">Module.Database(  )</div><h3>Description</h3><div class="desc spaceleft">Base address of module data block.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> database</li></ol></div></div><div class="func"><a name="Module.ExportDatabase"><h2>Module.ExportDatabase</h2></a><div class="title spaceleft">Module.ExportDatabase(  )</div><h3>Description</h3><div class="desc spaceleft">Base address of export database.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> exportdatabase</li></ol></div></div><div class="func"><a name="Module.ExportDataSize"><h2>Module.ExportDataSize</h2></a><div class="title spaceleft">Module.ExportDataSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of export data table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> exportdatasize</li></ol></div></div><div class="func"><a name="Module.IDATable"><h2>Module.IDATable</h2></a><div class="title spaceleft">Module.IDATable(  )</div><h3>Description</h3><div class="desc spaceleft">Return the base address of import data table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> idatable</li></ol></div></div><div class="func"><a name="Module.IATBase"><h2>Module.IATBase</h2></a><div class="title spaceleft">Module.IATBase(  )</div><h3>Description</h3><div class="desc spaceleft">Return the base address of import address table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> iatbase</li></ol></div></div><div class="func"><a name="Module.IATSize"><h2>Module.IATSize</h2></a><div class="title spaceleft">Module.IATSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return the size of IAT table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> iatsize</li></ol></div></div><div class="func"><a name="Module.RelocBase"><h2>Module.RelocBase</h2></a><div class="title spaceleft">Module.RelocBase(  )</div><h3>Description</h3><div class="desc spaceleft">Return base address of relocation table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> relocbase</li></ol></div></div><div class="func"><a name="Module.RelocSize"><h2>Module.RelocSize</h2></a><div class="title spaceleft">Module.RelocSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of relocation table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> relocsize</li></ol></div></div><div class="func"><a name="Module.ResBase"><h2>Module.ResBase</h2></a><div class="title spaceleft">Module.ResBase(  )</div><h3>Description</h3><div class="desc spaceleft">Return base address of resources.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> resbase</li></ol></div></div><div class="func"><a name="Module.ResSize"><h2>Module.ResSize</h2></a><div class="title spaceleft">Module.ResSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of resources.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> ressize</li></ol></div></div><div class="func"><a name="Module.TLSBase"><h2>Module.TLSBase</h2></a><div class="title spaceleft">Module.TLSBase(  )</div><h3>Description</h3><div class="desc spaceleft">Return base of TLS directory table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> tlsbase</li></ol></div></div><div class="func"><a name="Module.TLSSize"><h2>Module.TLSSize</h2></a><div class="title spaceleft">Module.TLSSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of TLS directory table.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> tlsize</li></ol></div></div><div class="func"><a name="Module.TLSCallback"><h2>Module.TLSCallback</h2></a><div class="title spaceleft">Module.TLSCallback(  )</div><h3>Description</h3><div class="desc spaceleft">Return first address of TLS callback or 0</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> tlscallback</li></ol></div></div><div class="func"><a name="Module.SFXBase"><h2>Module.SFXBase</h2></a><div class="title spaceleft">Module.SFXBase(  )</div><h3>Description</h3><div class="desc spaceleft">Return base of memory block with SFX.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> sfxbase</li></ol></div></div><div class="func"><a name="Module.SFXSize"><h2>Module.SFXSize</h2></a><div class="title spaceleft">Module.SFXSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of memory block with SFX.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> sfxsize</li></ol></div></div><div class="func"><a name="Module.RawHeaderSize"><h2>Module.RawHeaderSize</h2></a><div class="title spaceleft">Module.RawHeaderSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of PE header in file.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> headersize</li></ol></div></div><div class="func"><a name="Module.MemoryHeaderSize"><h2>Module.MemoryHeaderSize</h2></a><div class="title spaceleft">Module.MemoryHeaderSize(  )</div><h3>Description</h3><div class="desc spaceleft">Return size of PE header in memory.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> headersize</li></ol></div></div><div class="func"><a name="Module.FindAddress"><h2>Module.FindAddress</h2></a><div class="title spaceleft">Module.FindAddress(  )</div><h3>Description</h3><div class="desc spaceleft">Searches for the symbolic name and returns the address.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> address</li></ol></div></div><div class="func"><a name="Module.VAToRVA"><h2>Module.VAToRVA</h2></a><div class="title spaceleft">Module.VAToRVA( <i>number</i> va )</div><h3>Description</h3><div class="desc spaceleft">Converts the virtual address to a relative virtual address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> va<br /><div class="paramdesc">va</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> rva</li></ol></div></div><div class="func"><a name="Module.RVAToVA"><h2>Module.RVAToVA</h2></a><div class="title spaceleft">Module.RVAToVA( <i>number</i> rva )</div><h3>Description</h3><div class="desc spaceleft">Converts the relative virtual address to a virtual address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> rva<br /><div class="paramdesc">rva</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> va</li></ol></div></div><div class="func"><a name="Module.RVAToOffset"><h2>Module.RVAToOffset</h2></a><div class="title spaceleft">Module.RVAToOffset( <i>number</i> rva )</div><h3>Description</h3><div class="desc spaceleft">Converts the relative address to the offset.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> rva<br /><div class="paramdesc">rva</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> offset</li></ol></div></div><div class="func"><a name="Module.VAToOffset"><h2>Module.VAToOffset</h2></a><div class="title spaceleft">Module.VAToOffset( <i>number</i> rva )</div><h3>Description</h3><div class="desc spaceleft">Converts the virtual address to the offset.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> rva<br /><div class="paramdesc">rva</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> offset</li></ol></div></div><div class="func"><a name="Module.OffsetToRVA"><h2>Module.OffsetToRVA</h2></a><div class="title spaceleft">Module.OffsetToRVA( <i>number</i> offset )</div><h3>Description</h3><div class="desc spaceleft">Converts the file offset to relative virtual address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> offset<br /><div class="paramdesc">offset</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> rva</li></ol></div></div><div class="func"><a name="Module.OffsetToVA"><h2>Module.OffsetToVA</h2></a><div class="title spaceleft">Module.OffsetToVA( <i>number</i> offset )</div><h3>Description</h3><div class="desc spaceleft">Converts the file offset to virtual address.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> offset<br /><div class="paramdesc">offset</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> va</li></ol></div></div><a name="Process"><h1>Process</h1></a><ul><li><a href="#Process.Id">Process.Id</a></li><li><a href="#Process.Handle">Process.Handle</a></li><li><a href="#Process.Executable">Process.Executable</a></li><li><a href="#Process.Arguments">Process.Arguments</a></li><li><a href="#Process.NetDbg">Process.NetDbg</a></li><li><a href="#Process.RunDll">Process.RunDll</a></li><li><a href="#Process.MainThreadId">Process.MainThreadId</a></li><li><a href="#Process.RunInfo">Process.RunInfo</a></li><li><a href="#Process.SkipSystemBP">Process.SkipSystemBP</a></li><li><a href="#Process.PEBBlockAdress">Process.PEBBlockAdress</a></li></ul><div class="func"><a name="Process.Id"><h2>Process.Id</h2></a><div class="title spaceleft">Process.Id(  )</div><h3>Description</h3><div class="desc spaceleft">Returns debuggee Process Id</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> pid</li></ol></div></div><div class="func"><a name="Process.Handle"><h2>Process.Handle</h2></a><div class="title spaceleft">Process.Handle(  )</div><h3>Description</h3><div class="desc spaceleft">Returns debuggee Process Handle</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> handle</li></ol></div></div><div class="func"><a name="Process.Executable"><h2>Process.Executable</h2></a><div class="title spaceleft">Process.Executable(  )</div><h3>Description</h3><div class="desc spaceleft">Returns debuggee executable path</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> executable</li></ol></div></div><div class="func"><a name="Process.Arguments"><h2>Process.Arguments</h2></a><div class="title spaceleft">Process.Arguments(  )</div><h3>Description</h3><div class="desc spaceleft">Returns debuggee arguments.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> executable</li></ol></div></div><div class="func"><a name="Process.NetDbg"><h2>Process.NetDbg</h2></a><div class="title spaceleft">Process.NetDbg(  )</div><h3>Description</h3><div class="desc spaceleft">Returns if process is .Net executable</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> dotnet</li></ol></div></div><div class="func"><a name="Process.RunDll"><h2>Process.RunDll</h2></a><div class="title spaceleft">Process.RunDll(  )</div><h3>Description</h3><div class="desc spaceleft">Returns if executable is a dynamic library.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> rundll</li></ol></div></div><div class="func"><a name="Process.MainThreadId"><h2>Process.MainThreadId</h2></a><div class="title spaceleft">Process.MainThreadId(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the main thread id.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> threadid</li></ol></div></div><div class="func"><a name="Process.RunInfo"><h2>Process.RunInfo</h2></a><div class="title spaceleft">Process.RunInfo(  )</div><h3>Description</h3><div class="desc spaceleft">Returns a table of information given by OllyDbg, use with care.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> runinfo</li></ol></div></div><div class="func"><a name="Process.SkipSystemBP"><h2>Process.SkipSystemBP</h2></a><div class="title spaceleft">Process.SkipSystemBP(  )</div><h3>Description</h3><div class="desc spaceleft">Returns if the first system bp was hit.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> bphit</li></ol></div></div><div class="func"><a name="Process.PEBBlockAdress"><h2>Process.PEBBlockAdress</h2></a><div class="title spaceleft">Process.PEBBlockAdress(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the process environment block address.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> pebaddress</li></ol></div></div><a name="Registers"><h1>Registers</h1></a><ul><li><a href="#Register.EAX">Register.EAX</a></li><li><a href="#Register.ECX">Register.ECX</a></li><li><a href="#Register.EDX">Register.EDX</a></li><li><a href="#Register.EBX">Register.EBX</a></li><li><a href="#Register.ESP">Register.ESP</a></li><li><a href="#Register.EBP">Register.EBP</a></li><li><a href="#Register.ESI">Register.ESI</a></li><li><a href="#Register.EDI">Register.EDI</a></li><li><a href="#Register.EIP">Register.EIP</a></li><li><a href="#Register.AL">Register.AL</a></li><li><a href="#Register.CL">Register.CL</a></li><li><a href="#Register.BL">Register.BL</a></li><li><a href="#Register.DL">Register.DL</a></li></ul><div class="func"><a name="Register.EAX"><h2>Register.EAX</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EAX</div></div><div class="func"><a name="Register.ECX"><h2>Register.ECX</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global ECX</div></div><div class="func"><a name="Register.EDX"><h2>Register.EDX</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EDX</div></div><div class="func"><a name="Register.EBX"><h2>Register.EBX</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EBX</div></div><div class="func"><a name="Register.ESP"><h2>Register.ESP</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global ESP</div></div><div class="func"><a name="Register.EBP"><h2>Register.EBP</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EBP</div></div><div class="func"><a name="Register.ESI"><h2>Register.ESI</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global ESI</div></div><div class="func"><a name="Register.EDI"><h2>Register.EDI</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EDI</div></div><div class="func"><a name="Register.EIP"><h2>Register.EIP</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global EIP</div></div><div class="func"><a name="Register.AL"><h2>Register.AL</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global AL</div></div><div class="func"><a name="Register.CL"><h2>Register.CL</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global CL</div></div><div class="func"><a name="Register.BL"><h2>Register.BL</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global BL</div></div><div class="func"><a name="Register.DL"><h2>Register.DL</h2></a><h3>Remarks</h3><div class="remarks spaceleft">Also available as global DL</div></div><a name="Stack"><h1>Stack</h1></a><ul><li><a href="#Pop">Pop</a></li><li><a href="#Push">Push</a></li></ul><div class="func"><a name="Pop"><h2>Pop</h2></a><div class="title spaceleft">Pop( <i>boolean</i> refresh] )</div><h3>Description</h3><div class="desc spaceleft">Pops value from stack and returns it</div><h3>Arguments</h3><div class="params spaceleft"><ol><li>(optional) <i>boolean</i> refresh<br /><div class="paramdesc">Redraws CPU, by default its true</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> value</li></ol></div></div><div class="func"><a name="Push"><h2>Push</h2></a><div class="title spaceleft">Push( <i>number</i> value [, <i>boolean</i> refresh] )</div><h3>Description</h3><div class="desc spaceleft">Pushes a value onto the stack</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> value<br /><div class="paramdesc">value</div></li><li>(optional) <i>boolean</i> refresh<br /><div class="paramdesc">Redraws CPU, by default its true</div></li></ol></div></div><a name="String"><h1>String</h1></a><ul><li><a href="#string.split">string.split</a></li><li><a href="#string.ltrim">string.ltrim</a></li><li><a href="#string.rtrim">string.rtrim</a></li><li><a href="#string.trim">string.trim</a></li><li><a href="#string.hexdump">string.hexdump</a></li><li><a href="#string.hex">string.hex</a></li><li><a href="#string.strpos">string.strpos</a></li></ul><div class="func"><a name="string.split"><h2>string.split</h2></a><div class="title spaceleft">string.split( <i>string</i> str, <i>string</i> pattern )</div><h3>Description</h3><div class="desc spaceleft">Splits a string into pieces.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> str<br /><div class="paramdesc">Input string</div></li><li><i>string</i> pattern<br /><div class="paramdesc">Pattern to split</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> pieces</li></ol></div></div><div class="func"><a name="string.ltrim"><h2>string.ltrim</h2></a><div class="title spaceleft">string.ltrim( <i>string</i> str )</div><h3>Description</h3><div class="desc spaceleft">Removes all whitespaces on the left side from the input string</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> str<br /><div class="paramdesc">Input string</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> str</li></ol></div></div><div class="func"><a name="string.rtrim"><h2>string.rtrim</h2></a><div class="title spaceleft">string.rtrim( <i>string</i> str )</div><h3>Description</h3><div class="desc spaceleft">Removes all whitespaces on the right side from the input string</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> str<br /><div class="paramdesc">Input string</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> str</li></ol></div></div><div class="func"><a name="string.trim"><h2>string.trim</h2></a><div class="title spaceleft">string.trim( <i>string</i> str )</div><h3>Description</h3><div class="desc spaceleft">Removes all whitespaces on the left and right side from the input string</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> str<br /><div class="paramdesc">Input string</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> str</li></ol></div></div><div class="func"><a name="string.hexdump"><h2>string.hexdump</h2></a><div class="title spaceleft">string.hexdump( <i>string</i> str [, <i>string</i> spacer] )</div><h3>Description</h3><div class="desc spaceleft">Turns the input string into a binary string in the format of %02X</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> str<br /><div class="paramdesc">Input string</div></li><li>(optional) <i>string</i> spacer<br /><div class="paramdesc">Space string for each byte, default is empty</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> binary</li></ol></div></div><div class="func"><a name="string.hex"><h2>string.hex</h2></a><div class="title spaceleft">string.hex( <i>number</i> input )</div><h3>Description</h3><div class="desc spaceleft">Turns a value into a hex string, format is %08X</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> input<br /><div class="paramdesc">The input number</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> hexval</li></ol></div></div><div class="func"><a name="string.strpos"><h2>string.strpos</h2></a><div class="title spaceleft">string.strpos( <i>string</i> haystack, <i>string</i> needle [, <i>number</i> offset] )</div><h3>Description</h3><div class="desc spaceleft">Find the numeric position of the first occurrence of needle in the haystack string.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>string</i> haystack<br /><div class="paramdesc">Input string</div></li><li><i>string</i> needle<br /><div class="paramdesc">Search string</div></li><li>(optional) <i>number</i> offset<br /><div class="paramdesc">Starting offset</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> pos</li></ol></div><h3>Remarks</h3><div class="remarks spaceleft">Returns false if nothing is found</div></div><a name="Table"><h1>Table</h1></a><ul><li><a href="#table.copy">table.copy</a></li><li><a href="#table.print">table.print</a></li><li><a href="#table.hasvalue">table.hasvalue</a></li></ul><div class="func"><a name="table.copy"><h2>table.copy</h2></a><div class="title spaceleft">table.copy( <i>table</i> thetable )</div><h3>Description</h3><div class="desc spaceleft">Returns a copy of another table.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>table</i> thetable<br /><div class="paramdesc">Table to copy</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> copy</li></ol></div></div><div class="func"><a name="table.print"><h2>table.print</h2></a><div class="title spaceleft">table.print( <i>table</i> thetable )</div><h3>Description</h3><div class="desc spaceleft">Prints all contents of a table.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>table</i> thetable<br /><div class="paramdesc">Table to print</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> copy</li></ol></div></div><div class="func"><a name="table.hasvalue"><h2>table.hasvalue</h2></a><div class="title spaceleft">table.hasvalue( <i>table</i> thetable, <i>any</i> value )</div><h3>Description</h3><div class="desc spaceleft">Checks if the table has the given value.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>table</i> thetable<br /><div class="paramdesc">The table to search</div></li><li><i>any</i> value<br /><div class="paramdesc">The value to search.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> hasvalue</li></ol></div></div><a name="Thread"><h1>Thread</h1></a><ul><li><a href="#FindMainThread">FindMainThread</a></li><li><a href="#FindThreadById">FindThreadById</a></li><li><a href="#FindThreadByOrdinal">FindThreadByOrdinal</a></li><li><a href="#Thread.IsValid">Thread.IsValid</a></li><li><a href="#Thread.Id">Thread.Id</a></li><li><a href="#Thread.Type">Thread.Type</a></li><li><a href="#Thread.Ordinal">Thread.Ordinal</a></li><li><a href="#Thread.Name">Thread.Name</a></li><li><a href="#Thread.Handle">Thread.Handle</a></li><li><a href="#Thread.TIB">Thread.TIB</a></li><li><a href="#Thread.Entry">Thread.Entry</a></li><li><a href="#Thread.WindowHandle">Thread.WindowHandle</a></li><li><a href="#Thread.UserTime">Thread.UserTime</a></li><li><a href="#Thread.UserTime">Thread.UserTime</a></li><li><a href="#Thread.StackBottom">Thread.StackBottom</a></li><li><a href="#Thread.StackTop">Thread.StackTop</a></li><li><a href="#Thread.LastError">Thread.LastError</a></li><li><a href="#Thread.Registers">Thread.Registers</a></li></ul><div class="func"><a name="FindMainThread"><h2>FindMainThread</h2></a><div class="title spaceleft">FindMainThread(  )</div><h3>Description</h3><div class="desc spaceleft">Finds the main thread</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Thread</i> thread</li></ol></div></div><div class="func"><a name="FindThreadById"><h2>FindThreadById</h2></a><div class="title spaceleft">FindThreadById( <i>number</i> threadid )</div><h3>Description</h3><div class="desc spaceleft">Finds a thread by its id.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> threadid<br /><div class="paramdesc">The thread id.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Thread</i> thread</li></ol></div></div><div class="func"><a name="FindThreadByOrdinal"><h2>FindThreadByOrdinal</h2></a><div class="title spaceleft">FindThreadByOrdinal( <i>number</i> ordinal )</div><h3>Description</h3><div class="desc spaceleft">Finds a thread by ordinal.</div><h3>Arguments</h3><div class="params spaceleft"><ol><li><i>number</i> ordinal<br /><div class="paramdesc">The thread ordinal.</div></li></ol></div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>Thread</i> thread</li></ol></div></div><div class="func"><a name="Thread.IsValid"><h2>Thread.IsValid</h2></a><div class="title spaceleft">Thread.IsValid(  )</div><h3>Description</h3><div class="desc spaceleft">Returns if the thread is valid.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>boolean</i> valid</li></ol></div></div><div class="func"><a name="Thread.Id"><h2>Thread.Id</h2></a><div class="title spaceleft">Thread.Id(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread id.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> id</li></ol></div></div><div class="func"><a name="Thread.Type"><h2>Thread.Type</h2></a><div class="title spaceleft">Thread.Type(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread type.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> threadtype</li></ol></div></div><div class="func"><a name="Thread.Ordinal"><h2>Thread.Ordinal</h2></a><div class="title spaceleft">Thread.Ordinal(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread ordinal.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> ordinal</li></ol></div></div><div class="func"><a name="Thread.Name"><h2>Thread.Name</h2></a><div class="title spaceleft">Thread.Name(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread name.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>string</i> name</li></ol></div></div><div class="func"><a name="Thread.Handle"><h2>Thread.Handle</h2></a><div class="title spaceleft">Thread.Handle(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread handle.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> handle</li></ol></div></div><div class="func"><a name="Thread.TIB"><h2>Thread.TIB</h2></a><div class="title spaceleft">Thread.TIB(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread information block address.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> tibaddress</li></ol></div></div><div class="func"><a name="Thread.Entry"><h2>Thread.Entry</h2></a><div class="title spaceleft">Thread.Entry(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread entry address.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> entry</li></ol></div></div><div class="func"><a name="Thread.WindowHandle"><h2>Thread.WindowHandle</h2></a><div class="title spaceleft">Thread.WindowHandle(  )</div><h3>Description</h3><div class="desc spaceleft">Returns a window handle if it is owned by a window.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> handle</li></ol></div></div><div class="func"><a name="Thread.UserTime"><h2>Thread.UserTime</h2></a><div class="title spaceleft">Thread.UserTime(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread user time, time in user mode, 100u units or -1</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> usertime</li></ol></div></div><div class="func"><a name="Thread.UserTime"><h2>Thread.UserTime</h2></a><div class="title spaceleft">Thread.UserTime(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the thread system time, time in system mode, 100u units or -1</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> systemtime</li></ol></div></div><div class="func"><a name="Thread.StackBottom"><h2>Thread.StackBottom</h2></a><div class="title spaceleft">Thread.StackBottom(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the address of the stack bottom.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> stackbottom</li></ol></div></div><div class="func"><a name="Thread.StackTop"><h2>Thread.StackTop</h2></a><div class="title spaceleft">Thread.StackTop(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the address of the stack top.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> stacktop</li></ol></div></div><div class="func"><a name="Thread.LastError"><h2>Thread.LastError</h2></a><div class="title spaceleft">Thread.LastError(  )</div><h3>Description</h3><div class="desc spaceleft">Returns the last error with a translated error message.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>number</i> errorno</li><li><i>string</i> errormsg</li></ol></div></div><div class="func"><a name="Thread.Registers"><h2>Thread.Registers</h2></a><div class="title spaceleft">Thread.Registers(  )</div><h3>Description</h3><div class="desc spaceleft">Returns a table with all thread registers.</div><h3>Returns</h3><div class="returns spaceleft"><ol><li><i>table</i> registers</li></ol></div></div><h1>Constants</h1><ul><li><a href="#BP_">BP_</a></li><li><a href="#B_">B_</a></li><li><a href="#B_CONST8_">B_CONST8_</a></li><li><a href="#CPU_">CPU_</a></li><li><a href="#DAE_">DAE_</a></li><li><a href="#DAF_">DAF_</a></li><li><a href="#DAW_">DAW_</a></li><li><a href="#DA_">DA_</a></li><li><a href="#DEC_">DEC_</a></li><li><a href="#DX_">DX_</a></li><li><a href="#D_">D_</a></li><li><a href="#ID_">ID_</a></li><li><a href="#MB_">MB_</a></li><li><a href="#MEM_">MEM_</a></li><li><a href="#MM_">MM_</a></li><li><a href="#NULL">NULL</a></li><li><a href="#OPT_">OPT_</a></li><li><a href="#OP_">OP_</a></li><li><a href="#PAGE_">PAGE_</a></li><li><a href="#PF_">PF_</a></li><li><a href="#REG_">REG_</a></li><li><a href="#SEG_">SEG_</a></li></ul><div class="func"><a name="BP_"><h2>BP_</h2></a><ul><li>BP_BASE</li><div class="paramdesc">Mask to extract basic breakpoint type</div><li>BP_MANUAL</li><div class="paramdesc">Permanent breakpoint</div><li>BP_ONESHOT</li><div class="paramdesc">Stop and reset this bit</div><li>BP_TEMP</li><div class="paramdesc">Reset this bit and continue</div><li>BP_TRACE</li><div class="paramdesc">Used for hit trace</div><li>BP_SET</li><div class="paramdesc">Code INT3 is in memory, cmd is valid</div><li>BP_DISABLED</li><div class="paramdesc">Permanent breakpoint is disabled</div><li>BP_COND</li><div class="paramdesc">Conditional breakpoint</div><li>BP_PERIODICAL</li><div class="paramdesc">Periodical (pauses each PassCount)</div><li>BP_ACCESSMASK</li><div class="paramdesc">Access conditions (Memory+Hardware)</div><li>BP_READ</li><div class="paramdesc">Break on read memory access</div><li>BP_WRITE</li><div class="paramdesc">Break on write memory access</div><li>BP_EXEC</li><div class="paramdesc">Break on code execution</div><li>BP_BREAKMASK</li><div class="paramdesc">When to pause execution</div><li>BP_NOBREAK</li><div class="paramdesc">No pause</div><li>BP_CONDBREAK</li><div class="paramdesc">Pause if condition is true</div><li>BP_BREAK</li><div class="paramdesc">Pause always</div><li>BP_LOGMASK</li><div class="paramdesc">When to log value of expression</div><li>BP_NOLOG</li><div class="paramdesc">Don't log expression</div><li>BP_CONDLOG</li><div class="paramdesc">Log expression if condition is true</div><li>BP_LOG</li><div class="paramdesc">Log expression always</div><li>BP_ARGMASK</li><div class="paramdesc">When to log arguments of a function</div><li>BP_NOARG</li><div class="paramdesc">Don't log arguments</div><li>BP_CONDARG</li><div class="paramdesc">Log arguments if condition is true</div><li>BP_ARG</li><div class="paramdesc">Log arguments always</div><li>BP_RETMASK</li><div class="paramdesc">When to log return value of a function</div><li>BP_NORET</li><div class="paramdesc">Don't log return value</div><li>BP_CONDRET</li><div class="paramdesc">Log return value if condition is true</div><li>BP_RET</li><div class="paramdesc">Log return value always</div><li>BP_MANMASK</li><li>BP_CONFIRM</li><div class="paramdesc">Only calls to Setsteppingbreakpoint()</div></ul></div><div class="func"><a name="B_"><h2>B_</h2></a><ul><li>B_ARGMASK</li><div class="paramdesc">Mask to extract type of argument</div><li>B_NONE</li><div class="paramdesc">Operand absent</div><li>B_AL</li><div class="paramdesc">Register AL</div><li>B_AH</li><div class="paramdesc">Register AH</div><li>B_AX</li><div class="paramdesc">Register AX</div><li>B_CL</li><div class="paramdesc">Register CL</div><li>B_CX</li><div class="paramdesc">Register CX</div><li>B_DX</li><div class="paramdesc">Register DX</div><li>B_DXPORT</li><div class="paramdesc">Register DX as I/O port address</div><li>B_EAX</li><div class="paramdesc">Register EAX</div><li>B_EBX</li><div class="paramdesc">Register EBX</div><li>B_ECX</li><div class="paramdesc">Register ECX</div><li>B_EDX</li><div class="paramdesc">Register EDX</div><li>B_ACC</li><div class="paramdesc">Accumulator (AL/AX/EAX)</div><li>B_STRCNT</li><div class="paramdesc">Register CX or ECX as REPxx counter</div><li>B_DXEDX</li><div class="paramdesc">Register DX or EDX in DIV/MUL</div><li>B_BPEBP</li><div class="paramdesc">Register BP or EBP in ENTER/LEAVE</div><li>B_REG</li><div class="paramdesc">8/16/32-bit register in Reg</div><li>B_REG16</li><div class="paramdesc">16-bit register in Reg</div><li>B_REG32</li><div class="paramdesc">32-bit register in Reg</div><li>B_REGCMD</li><div class="paramdesc">16/32-bit register in last cmd byte</div><li>B_REGCMD8</li><div class="paramdesc">8-bit register in last cmd byte</div><li>B_ANYREG</li><div class="paramdesc">Reg field is unused, any allowed</div><li>B_INT</li><div class="paramdesc">8/16/32-bit register/memory in ModRM</div><li>B_INT8</li><div class="paramdesc">8-bit register/memory in ModRM</div><li>B_INT16</li><div class="paramdesc">16-bit register/memory in ModRM</div><li>B_INT32</li><div class="paramdesc">32-bit register/memory in ModRM</div><li>B_INT1632</li><div class="paramdesc">16/32-bit register/memory in ModRM</div><li>B_INT64</li><div class="paramdesc">64-bit integer in ModRM, memory only</div><li>B_INT128</li><div class="paramdesc">128-bit integer in ModRM, memory only</div><li>B_IMMINT</li><div class="paramdesc">8/16/32-bit int at immediate addr</div><li>B_INTPAIR</li><div class="paramdesc">Two signed 16/32 in ModRM, memory only</div><li>B_SEGOFFS</li><div class="paramdesc">16:16/16:32 absolute address in memory</div><li>B_STRDEST</li><div class="paramdesc">8/16/32-bit string dest, [ES:(E)DI]</div><li>B_STRDEST8</li><div class="paramdesc">8-bit string destination, [ES:(E)DI]</div><li>B_STRSRC</li><div class="paramdesc">8/16/32-bit string source, [(E)SI]</div><li>B_STRSRC8</li><div class="paramdesc">8-bit string source, [(E)SI]</div><li>B_XLATMEM</li><div class="paramdesc">8-bit memory in XLAT, [(E)BX+AL]</div><li>B_EAXMEM</li><div class="paramdesc">Reference to memory addressed by [EAX]</div><li>B_LONGDATA</li><div class="paramdesc">Long data in ModRM, mem only</div><li>B_ANYMEM</li><div class="paramdesc">Reference to memory, data unimportant</div><li>B_STKTOP</li><div class="paramdesc">16/32-bit int top of stack</div><li>B_STKTOPFAR</li><div class="paramdesc">Top of stack (16:16/16:32 far addr)</div><li>B_STKTOPEFL</li><div class="paramdesc">16/32-bit flags on top of stack</div><li>B_STKTOPA</li><div class="paramdesc">16/32-bit top of stack all registers</div><li>B_PUSH</li><div class="paramdesc">16/32-bit int push to stack</div><li>B_PUSHRET</li><div class="paramdesc">16/32-bit push of return address</div><li>B_PUSHRETF</li><div class="paramdesc">16:16/16:32-bit push of far retaddr</div><li>B_PUSHA</li><div class="paramdesc">16/32-bit push all registers</div><li>B_EBPMEM</li><div class="paramdesc">16/32-bit int at [EBP]</div><li>B_SEG</li><div class="paramdesc">Segment register in Reg</div><li>B_SEGNOCS</li><div class="paramdesc">Segment register in Reg, but not CS</div><li>B_SEGCS</li><div class="paramdesc">Segment register CS</div><li>B_SEGDS</li><div class="paramdesc">Segment register DS</div><li>B_SEGES</li><div class="paramdesc">Segment register ES</div><li>B_SEGFS</li><div class="paramdesc">Segment register FS</div><li>B_SEGGS</li><div class="paramdesc">Segment register GS</div><li>B_SEGSS</li><div class="paramdesc">Segment register SS</div><li>B_ST</li><div class="paramdesc">80-bit FPU register in last cmd byte</div><li>B_ST0</li><div class="paramdesc">80-bit FPU register ST0</div><li>B_ST1</li><div class="paramdesc">80-bit FPU register ST1</div><li>B_FLOAT32</li><div class="paramdesc">32-bit float in ModRM, memory only</div><li>B_FLOAT64</li><div class="paramdesc">64-bit float in ModRM, memory only</div><li>B_FLOAT80</li><div class="paramdesc">80-bit float in ModRM, memory only</div><li>B_BCD</li><div class="paramdesc">80-bit BCD in ModRM, memory only</div><li>B_MREG8x8</li><div class="paramdesc">MMX register as 8 8-bit integers</div><li>B_MMX8x8</li><div class="paramdesc">MMX reg/memory as 8 8-bit integers</div><li>B_MMX8x8DI</li><div class="paramdesc">MMX 8 8-bit integers at [DS:(E)DI]</div><li>B_MREG16x4</li><div class="paramdesc">MMX register as 4 16-bit integers</div><li>B_MMX16x4</li><div class="paramdesc">MMX reg/memory as 4 16-bit integers</div><li>B_MREG32x2</li><div class="paramdesc">MMX register as 2 32-bit integers</div><li>B_MMX32x2</li><div class="paramdesc">MMX reg/memory as 2 32-bit integers</div><li>B_MREG64</li><div class="paramdesc">MMX register as 1 64-bit integer</div><li>B_MMX64</li><div class="paramdesc">MMX reg/memory as 1 64-bit integer</div><li>B_3DREG</li><div class="paramdesc">3DNow! register as 2 32-bit floats</div><li>B_3DNOW</li><div class="paramdesc">3DNow! reg/memory as 2 32-bit floats</div><li>B_XMM0I32x4</li><div class="paramdesc">XMM0 as 4 32-bit integers</div><li>B_XMM0I64x2</li><div class="paramdesc">XMM0 as 2 64-bit integers</div><li>B_XMM0I8x16</li><div class="paramdesc">XMM0 as 16 8-bit integers</div><li>B_SREGF32x4</li><div class="paramdesc">SSE register as 4 32-bit floats</div><li>B_SREGF32L</li><div class="paramdesc">Low 32-bit float in SSE register</div><li>B_SREGF32x2L</li><div class="paramdesc">Low 2 32-bit floats in SSE register</div><li>B_SSEF32x4</li><div class="paramdesc">SSE reg/memory as 4 32-bit floats</div><li>B_SSEF32L</li><div class="paramdesc">Low 32-bit float in SSE reg/memory</div><li>B_SSEF32x2L</li><div class="paramdesc">Low 2 32-bit floats in SSE reg/memory</div><li>B_SREGF64x2</li><div class="paramdesc">SSE register as 2 64-bit floats</div><li>B_SREGF64L</li><div class="paramdesc">Low 64-bit float in SSE register</div><li>B_SSEF64x2</li><div class="paramdesc">SSE reg/memory as 2 64-bit floats</div><li>B_SSEF64L</li><div class="paramdesc">Low 64-bit float in SSE reg/memory</div><li>B_SREGI8x16</li><div class="paramdesc">SSE register as 16 8-bit sigints</div><li>B_SSEI8x16</li><div class="paramdesc">SSE reg/memory as 16 8-bit sigints</div><li>B_SSEI8x16DI</li><div class="paramdesc">SSE 16 8-bit sigints at [DS:(E)DI]</div><li>B_SSEI8x8L</li><div class="paramdesc">Low 8 8-bit ints in SSE reg/memory</div><li>B_SSEI8x4L</li><div class="paramdesc">Low 4 8-bit ints in SSE reg/memory</div><li>B_SSEI8x2L</li><div class="paramdesc">Low 2 8-bit ints in SSE reg/memory</div><li>B_SREGI16x8</li><div class="paramdesc">SSE register as 8 16-bit sigints</div><li>B_SSEI16x8</li><div class="paramdesc">SSE reg/memory as 8 16-bit sigints</div><li>B_SSEI16x4L</li><div class="paramdesc">Low 4 16-bit ints in SSE reg/memory</div><li>B_SSEI16x2L</li><div class="paramdesc">Low 2 16-bit ints in SSE reg/memory</div><li>B_SREGI32x4</li><div class="paramdesc">SSE register as 4 32-bit sigints</div><li>B_SREGI32L</li><div class="paramdesc">Low 32-bit sigint in SSE register</div><li>B_SREGI32x2L</li><div class="paramdesc">Low 2 32-bit sigints in SSE register</div><li>B_SSEI32x4</li><div class="paramdesc">SSE reg/memory as 4 32-bit sigints</div><li>B_SSEI32x2L</li><div class="paramdesc">Low 2 32-bit sigints in SSE reg/memory</div><li>B_SREGI64x2</li><div class="paramdesc">SSE register as 2 64-bit sigints</div><li>B_SSEI64x2</li><div class="paramdesc">SSE reg/memory as 2 64-bit sigints</div><li>B_SREGI64L</li><div class="paramdesc">Low 64-bit sigint in SSE register</div><li>B_EFL</li><div class="paramdesc">Flags register EFL</div><li>B_FLAGS8</li><div class="paramdesc">Flags (low byte)</div><li>B_OFFSET</li><div class="paramdesc">16/32 const offset from next command</div><li>B_BYTEOFFS</li><div class="paramdesc">8-bit sxt const offset from next cmd</div><li>B_FARCONST</li><div class="paramdesc">16:16/16:32 absolute address constant</div><li>B_DESCR</li><div class="paramdesc">16:32 descriptor in ModRM</div><li>B_1</li><div class="paramdesc">Immediate constant 1</div><li>B_CONST8</li><div class="paramdesc">Immediate 8-bit constant</div><li>B_CONST16</li><div class="paramdesc">Immediate 16-bit constant</div><li>B_CONST</li><div class="paramdesc">Immediate 8/16/32-bit constant</div><li>B_CONSTL</li><div class="paramdesc">Immediate 16/32-bit constant</div><li>B_SXTCONST</li><div class="paramdesc">Immediate 8-bit sign-extended to size</div><li>B_CR</li><div class="paramdesc">Control register in Reg</div><li>B_CR0</li><div class="paramdesc">Control register CR0</div><li>B_DR</li><div class="paramdesc">Debug register in Reg</div><li>B_MODMASK</li><div class="paramdesc">Mask to extract type modifier</div><li>B_NONSPEC</li><div class="paramdesc">Non-specific operand</div><li>B_UNSIGNED</li><div class="paramdesc">Decode as unsigned decimal</div><li>B_SIGNED</li><div class="paramdesc">Decode as signed decimal</div><li>B_BINARY</li><div class="paramdesc">Decode as binary (full hex) data</div><li>B_BITCNT</li><div class="paramdesc">Bit count</div><li>B_SHIFTCNT</li><div class="paramdesc">Shift count</div><li>B_COUNT</li><div class="paramdesc">General-purpose count</div><li>B_NOADDR</li><div class="paramdesc">Not an address</div><li>B_JMPCALL</li><div class="paramdesc">Near jump/call/return destination</div><li>B_JMPCALLFAR</li><div class="paramdesc">Far jump/call/return destination</div><li>B_STACKINC</li><div class="paramdesc">Unsigned stack increment/decrement</div><li>B_PORT</li><div class="paramdesc">I/O port</div><li>B_MEMORY</li><div class="paramdesc">Memory only, reg version different</div><li>B_REGISTER</li><div class="paramdesc">Register only, mem version different</div><li>B_MEMONLY</li><div class="paramdesc">Warn if operand in register</div><li>B_REGONLY</li><div class="paramdesc">Warn if operand in memory</div><li>B_32BITONLY</li><div class="paramdesc">Warn if 16-bit operand</div><li>B_NOESP</li><div class="paramdesc">ESP is not allowed</div><li>B_SHOWSIZE</li><div class="paramdesc">Always show argument size in disasm</div><li>B_CHG</li><div class="paramdesc">Changed, old contents is not used</div><li>B_UPD</li><div class="paramdesc">Modified using old contents</div><li>B_PSEUDO</li><div class="paramdesc">Pseoudooperand, not in assembler cmd</div><li>B_NOSEG</li><div class="paramdesc">Don't add offset of selector</div></ul></div><div class="func"><a name="B_CONST8_"><h2>B_CONST8_</h2></a><ul><li>B_CONST8_2</li><div class="paramdesc">Immediate 8-bit const, second in cmd</div></ul></div><div class="func"><a name="CPU_"><h2>CPU_</h2></a><ul><li>CPU_ASMHIST</li><div class="paramdesc">Add change to Disassembler history</div><li>CPU_ASMCENTER</li><div class="paramdesc">Make address in the middle of window</div><li>CPU_ASMFOCUS</li><div class="paramdesc">Move focus to Disassembler</div><li>CPU_DUMPHIST</li><div class="paramdesc">Add change to Dump history</div><li>CPU_DUMPFIRST</li><div class="paramdesc">Make address the first byte in Dump</div><li>CPU_DUMPFOCUS</li><div class="paramdesc">Move focus to Dump</div><li>CPU_STACKFOCUS</li><div class="paramdesc">Move focus to Stack</div><li>CPU_STACKCTR</li><div class="paramdesc">Center stack instead moving to top</div><li>CPU_REGAUTO</li><div class="paramdesc">Automatically switch to FPU/MMX/3DNow!</div><li>CPU_NOCREATE</li><div class="paramdesc">Don't create CPU window if absent</div><li>CPU_REDRAW</li><div class="paramdesc">Redraw CPU window immediately</div><li>CPU_NOFOCUS</li><div class="paramdesc">Don't assign focus to main window</div><li>CPU_RUNTRACE</li><div class="paramdesc">asmaddr is run trace backstep</div><li>CPU_NOTRACE</li><div class="paramdesc">Stop run trace display</div></ul></div><div class="func"><a name="DAE_"><h2>DAE_</h2></a><ul><li>DAE_NOERR</li><div class="paramdesc">No error</div><li>DAE_BADCMD</li><div class="paramdesc">Unrecognized command</div><li>DAE_CROSS</li><div class="paramdesc">Command crosses end of memory block</div><li>DAE_MEMORY</li><div class="paramdesc">Register where only memory allowed</div><li>DAE_REGISTER</li><div class="paramdesc">Memory where only register allowed</div><li>DAE_LOCK</li><div class="paramdesc">LOCK prefix is not allowed</div><li>DAE_BADSEG</li><div class="paramdesc">Invalid segment register</div><li>DAE_SAMEPREF</li><div class="paramdesc">Two prefixes from the same group</div><li>DAE_MANYPREF</li><div class="paramdesc">More than 4 prefixes</div><li>DAE_BADCR</li><div class="paramdesc">Invalid CR register</div><li>DAE_INTERN</li><div class="paramdesc">Internal error</div></ul></div><div class="func"><a name="DAF_"><h2>DAF_</h2></a><ul><li>DAF_NOCOND</li><div class="paramdesc">Unconditional command</div><li>DAF_TRUE</li><div class="paramdesc">Condition is true</div><li>DAF_FALSE</li><div class="paramdesc">Condition is false</div><li>DAF_ANYCOND</li><div class="paramdesc">Condition is not predictable</div></ul></div><div class="func"><a name="DAW_"><h2>DAW_</h2></a><ul><li>DAW_DATASIZE</li><div class="paramdesc">Superfluous data size prefix</div><li>DAW_ADDRSIZE</li><div class="paramdesc">Superfluous address size prefix</div><li>DAW_SEGPREFIX</li><div class="paramdesc">Superfluous segment override prefix</div><li>DAW_REPPREFIX</li><div class="paramdesc">Superfluous REPxx prefix</div><li>DAW_DEFSEG</li><div class="paramdesc">Segment prefix coincides with default</div><li>DAW_JMP16</li><div class="paramdesc">16-bit jump, call or return</div><li>DAW_FARADDR</li><div class="paramdesc">Far jump or call</div><li>DAW_SEGMOD</li><div class="paramdesc">Modifies segment register</div><li>DAW_PRIV</li><div class="paramdesc">Privileged command</div><li>DAW_IO</li><div class="paramdesc">I/O command</div><li>DAW_SHIFT</li><div class="paramdesc">Shift out of range 1..31</div><li>DAW_LOCK</li><div class="paramdesc">Command with valid LOCK prefix</div><li>DAW_STACK</li><div class="paramdesc">Unaligned stack operation</div><li>DAW_NOESP</li><div class="paramdesc">Suspicious use of stack pointer</div><li>DAW_RARE</li><div class="paramdesc">Rare, seldom used command</div><li>DAW_NONCLASS</li><div class="paramdesc">Non-standard or non-documented code</div><li>DAW_INTERRUPT</li><div class="paramdesc">Interrupt command</div></ul></div><div class="func"><a name="DA_"><h2>DA_</h2></a><ul><li>DA_TEXT</li><div class="paramdesc">Decode command to text and comment</div><li>DA_HILITE</li><div class="paramdesc">Use syntax highlighting (set t_disasm)</div><li>DA_OPCOMM</li><div class="paramdesc">Comment operands</div><li>DA_DUMP</li><div class="paramdesc">Dump command to hexadecimal text</div><li>DA_MEMORY</li><div class="paramdesc">OK to read memory and use labels</div><li>DA_NOIMPORT</li><div class="paramdesc">When reading memory, hold the imports</div><li>DA_RTLOGMEM</li><div class="paramdesc">Use memory saved by run trace</div><li>DA_NOSTACKP</li><div class="paramdesc">Hide 'Stack' prefix in comments</div><li>DA_STEPINTO</li><div class="paramdesc">Enter CALL when predicting registers</div><li>DA_SHOWARG</li><div class="paramdesc">Use predict if address ESP/EBP-based</div><li>DA_NOPSEUDO</li><div class="paramdesc">Skip pseudooperands</div><li>DA_FORHELP</li><div class="paramdesc">Decode operands for command help</div></ul></div><div class="func"><a name="DEC_"><h2>DEC_</h2></a><ul><li>DEC_TYPEMASK</li><div class="paramdesc">Type of analyzed byte</div><li>DEC_UNKNOWN</li><div class="paramdesc">Not analyzed, treat as command</div><li>DEC_NEXTCODE</li><div class="paramdesc">Next byte of command</div><li>DEC_NEXTDATA</li><div class="paramdesc">Next byte of data</div><li>DEC_FILLDATA</li><div class="paramdesc">Not recognized, treat as byte data</div><li>DEC_INT</li><div class="paramdesc">First byte of integer</div><li>DEC_SWITCH</li><div class="paramdesc">First byte of switch item or count</div><li>DEC_DATA</li><div class="paramdesc">First byte of integer data</div><li>DEC_DB</li><div class="paramdesc">First byte of byte string</div><li>DEC_DUMP</li><div class="paramdesc">First byte of byte string with dump</div><li>DEC_ASCII</li><div class="paramdesc">First byte of ASCII string</div><li>DEC_ASCCNT</li><div class="paramdesc">Next chunk of ASCII string</div><li>DEC_UNICODE</li><div class="paramdesc">First byte of UNICODE string</div><li>DEC_UNICNT</li><div class="paramdesc">Next chunk of UNICODE string</div><li>DEC_FLOAT</li><div class="paramdesc">First byte of floating number</div><li>DEC_GUID</li><div class="paramdesc">First byte of GUID</div><li>DEC_NETCMD</li><div class="paramdesc">First byte of .NET (CIL) command</div><li>DEC_JMPNET</li><div class="paramdesc">First byte of .NET at jump destination</div><li>DEC_CALLNET</li><div class="paramdesc">First byte of .NET at call destination</div><li>DEC_COMMAND</li><div class="paramdesc">First byte of ordinary command</div><li>DEC_JMPDEST</li><div class="paramdesc">First byte of cmd at jump destination</div><li>DEC_CALLDEST</li><div class="paramdesc">First byte of cmd at call destination</div><li>DEC_FILLING</li><div class="paramdesc">Command used to fill gaps</div><li>DEC_PROCMASK</li><div class="paramdesc">Procedure analysis</div><li>DEC_NOPROC</li><div class="paramdesc">Outside the procedure</div><li>DEC_PROC</li><div class="paramdesc">Start of procedure</div><li>DEC_PEND</li><div class="paramdesc">End of procedure</div><li>DEC_PBODY</li><div class="paramdesc">Body of procedure</div><li>DEC_TRACED</li><div class="paramdesc">Hit when traced</div></ul></div><div class="func"><a name="DX_"><h2>DX_</h2></a><ul><li>DX_ZEROMASK</li><div class="paramdesc">How to decode FLAGS.Z flag</div><li>DX_JE</li><div class="paramdesc">JE, JNE instead of JZ, JNZ</div><li>DX_JZ</li><div class="paramdesc">JZ, JNZ instead of JE, JNE</div><li>DX_CARRYMASK</li><div class="paramdesc">How to decode FLAGS.C flag</div><li>DX_JB</li><div class="paramdesc">JAE, JB instead of JC, JNC</div><li>DX_JC</li><div class="paramdesc">JC, JNC instead of JAE, JB</div><li>DX_WONKYTRAP</li><div class="paramdesc">Don't single-step this command</div></ul></div><div class="func"><a name="D_"><h2>D_</h2></a><ul><li>D_NONE</li><div class="paramdesc">No special features</div><li>D_CMDTYPE</li><div class="paramdesc">Mask to extract type of command</div><li>D_CMD</li><div class="paramdesc">Ordinary (none of listed below)</div><li>D_MOV</li><div class="paramdesc">Move to or from integer register</div><li>D_MOVC</li><div class="paramdesc">Conditional move to integer register</div><li>D_SETC</li><div class="paramdesc">Conditional set integer register</div><li>D_TEST</li><div class="paramdesc">Used to test data (CMP, TEST, AND...)</div><li>D_STRING</li><div class="paramdesc">String command with REPxxx prefix</div><li>D_JMP</li><div class="paramdesc">Unconditional near jump</div><li>D_JMPFAR</li><div class="paramdesc">Unconditional far jump</div><li>D_JMC</li><div class="paramdesc">Conditional jump on flags</div><li>D_JMCX</li><div class="paramdesc">Conditional jump on (E)CX (and flags)</div><li>D_PUSH</li><div class="paramdesc">PUSH exactly 1 (d)word of data</div><li>D_POP</li><div class="paramdesc">POP exactly 1 (d)word of data</div><li>D_CALL</li><div class="paramdesc">Plain near call</div><li>D_CALLFAR</li><div class="paramdesc">Far call</div><li>D_INT</li><div class="paramdesc">Interrupt</div><li>D_RET</li><div class="paramdesc">Plain near return from call</div><li>D_RETFAR</li><div class="paramdesc">Far return or IRET</div><li>D_FPU</li><div class="paramdesc">FPU command</div><li>D_MMX</li><div class="paramdesc">MMX instruction, incl. SSE extensions</div><li>D_3DNOW</li><div class="paramdesc">3DNow! instruction</div><li>D_SSE</li><div class="paramdesc">SSE, SSE2, SSE3 etc. instruction</div><li>D_IO</li><div class="paramdesc">Accesses I/O ports</div><li>D_SYS</li><div class="paramdesc">Legal but useful in system code only</div><li>D_PRIVILEGED</li><div class="paramdesc">Privileged (non-Ring3) command</div><li>D_DATA</li><div class="paramdesc">Data recognized by Analyser</div><li>D_PSEUDO</li><div class="paramdesc">Pseudocommand, for search models only</div><li>D_PREFIX</li><div class="paramdesc">Standalone prefix</div><li>D_BAD</li><div class="paramdesc">Bad or unrecognized command</div><li>D_SIZE01</li><div class="paramdesc">Bit 0x01 in last cmd is data size</div><li>D_POSTBYTE</li><div class="paramdesc">Command continues in postbyte</div><li>D_LONGFORM</li><div class="paramdesc">Long form of string command</div><li>D_SIZEMASK</li><div class="paramdesc">Mask for data/address size dependence</div><li>D_DATA16</li><div class="paramdesc">Requires 16-bit data size</div><li>D_DATA32</li><div class="paramdesc">Requires 32-bit data size</div><li>D_ADDR16</li><div class="paramdesc">Requires 16-bit address size</div><li>D_ADDR32</li><div class="paramdesc">Requires 32-bit address size</div><li>D_MUSTMASK</li><div class="paramdesc">Mask for fixed set of prefixes</div><li>D_NOMUST</li><div class="paramdesc">No obligatory prefixes (default)</div><li>D_MUST66</li><div class="paramdesc">(SSE) Requires 66, no F2 or F3</div><li>D_MUSTF2</li><div class="paramdesc">(SSE) Requires F2, no 66 or F3</div><li>D_MUSTF3</li><div class="paramdesc">(SSE) Requires F3, no 66 or F2</div><li>D_MUSTNONE</li><div class="paramdesc">(MMX,SSE) Requires no 66, F2 or F3</div><li>D_NEEDF2</li><div class="paramdesc">(SSE) Requires F2, no F3</div><li>D_NEEDF3</li><div class="paramdesc">(SSE) Requires F3, no F2</div><li>D_NOREP</li><div class="paramdesc">Must not include F2 or F3</div><li>D_MUSTREP</li><div class="paramdesc">Must include F3 (REP)</div><li>D_MUSTREPE</li><div class="paramdesc">Must include F3 (REPE)</div><li>D_MUSTREPNE</li><div class="paramdesc">Must include F2 (REPNE)</div><li>D_LOCKABLE</li><div class="paramdesc">Allows for F0 (LOCK, memory only)</div><li>D_BHINT</li><div class="paramdesc">Allows for branch hints (2E, 3E)</div><li>D_MEMORY</li><div class="paramdesc">Mod field must indicate memory</div><li>D_REGISTER</li><div class="paramdesc">Mod field must indicate register</div><li>D_FLAGMASK</li><div class="paramdesc">Mask to extract modified flags</div><li>D_NOFLAGS</li><div class="paramdesc">Flags S,Z,P,O,C remain unchanged</div><li>D_ALLFLAGS</li><div class="paramdesc">Modifies flags S,Z,P,O,C</div><li>D_FLAGZ</li><div class="paramdesc">Modifies flag Z only</div><li>D_FLAGC</li><div class="paramdesc">Modifies flag C only</div><li>D_FLAGSCO</li><div class="paramdesc">Modifies flag C and O only</div><li>D_FLAGD</li><div class="paramdesc">Modifies flag D only</div><li>D_FLAGSZPC</li><div class="paramdesc">Modifies flags Z, P and C only (FPU)</div><li>D_NOCFLAG</li><div class="paramdesc">S,Z,P,O modified, C unaffected</div><li>D_FPUMASK</li><div class="paramdesc">Mask for effects on FPU stack</div><li>D_FPUSAME</li><div class="paramdesc">Doesn't rotate FPU stack (default)</div><li>D_FPUPOP</li><div class="paramdesc">Pops FPU stack</div><li>D_FPUPOP2</li><div class="paramdesc">Pops FPU stack twice</div><li>D_FPUPUSH</li><div class="paramdesc">Pushes FPU stack</div><li>D_CHGESP</li><div class="paramdesc">Command indirectly modifies ESP</div><li>D_HLADIR</li><div class="paramdesc">Nonstandard order of operands in HLA</div><li>D_WILDCARD</li><div class="paramdesc">Mnemonics contains W/D wildcard ('*')</div><li>D_COND</li><div class="paramdesc">Conditional (action depends on flags)</div><li>D_USESCARRY</li><div class="paramdesc">Uses Carry flag</div><li>D_USEMASK</li><div class="paramdesc">Mask to detect unusual commands</div><li>D_RARE</li><div class="paramdesc">Rare or obsolete in Win32 apps</div><li>D_SUSPICIOUS</li><div class="paramdesc">Suspicious command</div><li>D_UNDOC</li><div class="paramdesc">Undocumented command</div></ul></div><div class="func"><a name="ID_"><h2>ID_</h2></a><ul><li>ID_YES</li><li>ID_NO</li><li>ID_CANCEL</li></ul></div><div class="func"><a name="MB_"><h2>MB_</h2></a><ul><li>MB_OK</li><li>MB_OKCANCEL</li><li>MB_ABORTRETRYIGNORE</li><li>MB_YESNOCANCEL</li><li>MB_YESNO</li><li>MB_RETRYCANCEL</li><li>MB_CANCELTRYCONTINUE</li><li>MB_ICONHAND</li><li>MB_ICONQUESTION</li><li>MB_ICONEXCLAMATION</li><li>MB_ICONASTERISK</li><li>MB_DEFBUTTON1</li><li>MB_DEFBUTTON2</li><li>MB_DEFBUTTON3</li><li>MB_APPLMODAL</li><li>MB_SYSTEMMODAL</li><li>MB_TASKMODAL</li><li>MB_NOFOCUS</li><li>MB_SETFOREGROUND</li><li>MB_DEFAULT_DESKTOP_ONLY</li><li>MB_TOPMOST</li><li>MB_RIGHT</li><li>MB_RTLREADING</li></ul></div><div class="func"><a name="MEM_"><h2>MEM_</h2></a><ul><li>MEM_COMMIT</li><div class="paramdesc">Allocates memory charges (from the overall size of memory and the paging files on disk) for the specified reserved memory pages</div><li>MEM_RESERVE</li><div class="paramdesc">Reserves a range of the process's virtual address space without allocating any actual physical storage in memory or in the paging file on disk</div><li>MEM_DECOMMIT</li><div class="paramdesc">Decommits the specified region of committed pages. After the operation, the pages are in the reserved state</div><li>MEM_RELEASE</li><div class="paramdesc">Releases the specified region of pages. After this operation, the pages are in the free state. If you specify this value, dwSize must be 0 (zero), and lpAddress must point to the base address returned by the RemoteAlloc function when the region is reserved</div><li>MEM_RESET</li><div class="paramdesc">Indicates that data in the memory range specified by lpAddress and dwSize is no longer of interest</div><li>MEM_TOP_DOWN</li><div class="paramdesc">Allocates memory at the highest possible address. This can be slower than regular allocations, especially when there are many allocations</div><li>MEM_WRITE_WATCH</li><div class="paramdesc">Causes the system to track pages that are written to in the allocated region. If you specify this value, you must also specify MEM_RESERVE</div><li>MEM_PHYSICAL</li><div class="paramdesc">Reserves an address range that can be used to map Address Windowing Extensions (AWE) pages</div><li>MEM_LARGE_PAGES</li><div class="paramdesc">Allocates memory using large page support. The size and alignment must be a multiple of the large-page minimum</div></ul></div><div class="func"><a name="MM_"><h2>MM_</h2></a><ul><li>MM_REPORT</li><div class="paramdesc">Display error message if unreadable</div><li>MM_SILENT</li><div class="paramdesc">Don't display error message</div><li>MM_NORESTORE</li><div class="paramdesc">Don't remove/set INT3 breakpoints</div><li>MM_PARTIAL</li><div class="paramdesc">Allow less data than requested</div><li>MM_WRITETHRU</li><div class="paramdesc">Write immediately to memory</div><li>MM_REMOVEINT3</li><div class="paramdesc">Writememory(): remove INT3 breaks</div><li>MM_ADJUSTINT3</li><div class="paramdesc">Writememory(): adjust INT3 breaks</div><li>MM_FAILGUARD</li><div class="paramdesc">Fail if memory is guarded</div><li>MM_BPMASK</li><div class="paramdesc">Mask to extract memory breakpoints</div><li>MM_BPREAD</li><div class="paramdesc">Fail if memory break on read is set</div><li>MM_BPWRITE</li><div class="paramdesc">Fail if memory break on write is set</div><li>MM_BPEXEC</li><div class="paramdesc">Fail if memory break on exec is set</div></ul></div><div class="func"><a name="NULL"><h2>NULL</h2></a><ul><li>NULL</li></ul></div><div class="func"><a name="OPT_"><h2>OPT_</h2></a><ul><li>OPT_NONE</li><div class="paramdesc">Default</div><li>OPT_PERMANENT</li><div class="paramdesc">The option will be stored permanently</div></ul></div><div class="func"><a name="OP_"><h2>OP_</h2></a><ul><li>OP_SOMEREG</li><div class="paramdesc">Mask for any kind of register</div><li>OP_REGISTER</li><div class="paramdesc">Operand is a general-purpose register</div><li>OP_SEGREG</li><div class="paramdesc">Operand is a segment register</div><li>OP_FPUREG</li><div class="paramdesc">Operand is a FPU register</div><li>OP_MMXREG</li><div class="paramdesc">Operand is a MMX register</div><li>OP_3DNOWREG</li><div class="paramdesc">Operand is a 3DNow! register</div><li>OP_SSEREG</li><div class="paramdesc">Operand is a SSE register</div><li>OP_CREG</li><div class="paramdesc">Operand is a control register</div><li>OP_DREG</li><div class="paramdesc">Operand is a debug register</div><li>OP_MEMORY</li><div class="paramdesc">Operand is in memory</div><li>OP_CONST</li><div class="paramdesc">Operand is an immediate constant</div><li>OP_PORT</li><div class="paramdesc">Operand is an I/O port</div><li>OP_INVALID</li><div class="paramdesc">Invalid operand, like reg in mem-only</div><li>OP_PSEUDO</li><div class="paramdesc">Pseudooperand (not in mnenonics)</div><li>OP_MOD</li><div class="paramdesc">Command may change/update operand</div><li>OP_MODREG</li><div class="paramdesc">Memory, but modifies reg (POP,MOVSD)</div><li>OP_REL</li><div class="paramdesc">Relative or fixuped const or address</div><li>OP_IMPORT</li><div class="paramdesc">Value imported from different module</div><li>OP_SELECTOR</li><div class="paramdesc">Includes immediate selector</div><li>OP_INDEXED</li><div class="paramdesc">Memory address contains registers</div><li>OP_OPCONST</li><div class="paramdesc">Memory address contains constant</div><li>OP_ADDR16</li><div class="paramdesc">16-bit memory address</div><li>OP_ADDR32</li><div class="paramdesc">Explicit 32-bit memory address</div><li>OP_OFFSOK</li><div class="paramdesc">Offset to selector valid</div><li>OP_ADDROK</li><div class="paramdesc">Address valid</div><li>OP_VALUEOK</li><div class="paramdesc">Value (max. 16 bytes) valid</div><li>OP_PREDADDR</li><div class="paramdesc">Address predicted, not actual</div><li>OP_PREDVAL</li><div class="paramdesc">Value predicted, not actual</div><li>OP_RTLOGMEM</li><div class="paramdesc">Memory contents got from run trace</div><li>OP_ACTVALID</li><div class="paramdesc">Actual value is valid</div><li>OP_ANYMEM</li><div class="paramdesc">Any memory location</div><li>OP_ANY</li><div class="paramdesc">Any operand</div></ul></div><div class="func"><a name="PAGE_"><h2>PAGE_</h2></a><ul><li>PAGE_NOACCESS</li><div class="paramdesc">Disables all access to the committed region of pages</div><li>PAGE_READONLY</li><div class="paramdesc">Enables read-only access to the committed region of pages</div><li>PAGE_READWRITE</li><div class="paramdesc">Enables read-only or read/write access to the committed region of pages</div><li>PAGE_WRITECOPY</li><div class="paramdesc">Enables read-only or copy-on-write access to a mapped view of a file mapping object</div><li>PAGE_EXECUTE</li><div class="paramdesc">Enables execute access to the committed region of pages</div><li>PAGE_EXECUTE_READ</li><div class="paramdesc">Enables execute or read-only access to the committed region of pages</div><li>PAGE_EXECUTE_READWRITE</li><div class="paramdesc">Enables execute, read-only, or read/write access to the committed region of pages</div><li>PAGE_EXECUTE_WRITECOPY</li><div class="paramdesc">Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object</div><li>PAGE_GUARD</li><div class="paramdesc">Pages in the region become guard pages. Any attempt to access a guard page causes the system to raise a STATUS_GUARD_PAGE_VIOLATION exception and turn off the guard page status</div><li>PAGE_NOCACHE</li><div class="paramdesc">Sets all pages to be non-cachable. Applications should not use this attribute except when explicitly required for a device</div><li>PAGE_WRITECOMBINE</li><div class="paramdesc">Sets all pages to be write-combined</div></ul></div><div class="func"><a name="PF_"><h2>PF_</h2></a><ul><li>PF_SEGMASK</li><div class="paramdesc">Mask for segment override prefixes</div><li>PF_ES</li><div class="paramdesc">0x26, ES segment override</div><li>PF_CS</li><div class="paramdesc">0x2E, CS segment override</div><li>PF_SS</li><div class="paramdesc">0x36, SS segment override</div><li>PF_DS</li><div class="paramdesc">0x3E, DS segment override</div><li>PF_FS</li><div class="paramdesc">0x64, FS segment override</div><li>PF_GS</li><div class="paramdesc">0x65, GS segment override</div><li>PF_DSIZE</li><div class="paramdesc">0x66, data size override</div><li>PF_ASIZE</li><div class="paramdesc">0x67, address size override</div><li>PF_LOCK</li><div class="paramdesc">0xF0, bus lock</div><li>PF_REPMASK</li><div class="paramdesc">Mask for repeat prefixes</div><li>PF_REPNE</li><div class="paramdesc">0xF2, REPNE prefix</div><li>PF_REP</li><div class="paramdesc">0xF3, REP/REPE prefix</div><li>PF_BYTE</li><div class="paramdesc">Size bit in command, used in cmdexec</div><li>PF_MUSTMASK</li><div class="paramdesc">Necessary prefixes, used in t_asmmod</div><li>PF_66</li><div class="paramdesc">Alternative names for SSE prefixes</div><li>PF_F2</li><li>PF_F3</li><li>PF_HINT</li><div class="paramdesc">Alternative names for branch hints</div><li>PF_NOTTAKEN</li><li>PF_TAKEN</li></ul></div><div class="func"><a name="REG_"><h2>REG_</h2></a><ul><li>REG_UNDEF</li><div class="paramdesc">Codes of general purpose registers</div><li>REG_EAX</li><li>REG_ECX</li><li>REG_EDX</li><li>REG_EBX</li><li>REG_ESP</li><li>REG_EBP</li><li>REG_ESI</li><li>REG_EDI</li><li>REG_BYTE</li><div class="paramdesc">Flag used in switch analysis</div><li>REG_AL</li><div class="paramdesc">Symbolic indices of 8-bit registers</div><li>REG_CL</li><li>REG_DL</li><li>REG_BL</li><li>REG_AH</li><li>REG_CH</li><li>REG_DH</li><li>REG_BH</li><li>REG_R8</li><div class="paramdesc">8-bit pseudoregister R8</div><li>REG_R16</li><div class="paramdesc">16-bit pseudoregister R16</div><li>REG_R32</li><div class="paramdesc">32-bit pseudoregister R32</div><li>REG_ANY</li><div class="paramdesc">Pseudoregister FPUREG, MMXREG etc.</div><li>REG_RA</li><div class="paramdesc">32-bit semi-defined pseudoregister RA</div><li>REG_RB</li><div class="paramdesc">32-bit semi-defined pseudoregister RB</div></ul></div><div class="func"><a name="SEG_"><h2>SEG_</h2></a><ul><li>SEG_UNDEF</li><div class="paramdesc">Codes of segment/selector registers</div><li>SEG_ES</li><li>SEG_CS</li><li>SEG_SS</li><li>SEG_DS</li><li>SEG_FS</li><li>SEG_GS</li><li>SEG_ANY</li><div class="paramdesc">Segment pseudoregister SEG</div></ul></div><div class="footer"><a href="#top">Top</a></div></body></html>